fix(#8): remove SSM credential logging at Info level

[fullsend-ai-coder]

Remove logger.Infof calls for TokenValue and StreamUrl in runSSMsession (cmd/ocm-backplane/cloud/ssm.go). These sensitive AWS SSM session credentials were logged at Info level on every invocation of "ocm-backplane cloud ssm-session", exposing the websocket auth token to terminal scrollback and log collectors. The token alone is sufficient to hijack an active SSM session to a customer EC2 instance (CWE-532, CWE-312).

SessionId is retained at Debug level since it is not a secret but useful for troubleshooting. The session JSON is already passed privately to session-manager-plugin via argv, so these log lines served no functional purpose.

Added three tests verifying that TokenValue, StreamUrl, and SessionId do not appear in log output at Info level.

Note: golangci-lint could not run in the sandbox (network restriction on install). go vet passed. One pre-existing test failure in common_test.go (network-dependent test blocked by sandbox) is unrelated to this change.

---

Closes #8

Post-script verification

• Branch is not main/master (agent/8-remove-ssm-token-logging)
• Secret scan passed (gitleaks — ae64d7cf510a866657b8dcb2881b8c7dc3fe2a16..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[krishvoor]

/fs-review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:38 AM UTC · Completed 8:42 AM UTC
Commit: ae64d7c · View workflow run →

[fullsend-ai-review]

Looks good to me

Findings

Low

• [test-integrity] cmd/ocm-backplane/cloud/ssm_test.go — No positive test verifying SessionId IS emitted at Debug level. A regression removing the Debugf call would not be caught.
  Remediation: Add a test that sets log.SetLevel(log.DebugLevel), runs runSSMsession, and asserts the output contains the session ID.

• [test-integrity] cmd/ocm-backplane/cloud/ssm_test.go — Tests modify global logrus state (SetLevel, SetOutput). If a test panics before AfterEach, state may leak into subsequent tests.
  Remediation: Consider using DeferCleanup (Ginkgo v2) which runs even on panic/skip.

• [CWE-214] cmd/ocm-backplane/cloud/ssm.go — Pre-existing: session JSON containing credentials is passed as command-line argument to session-manager-plugin, visible via /proc/<pid>/cmdline. Not introduced by this PR.

• [comment-style] cmd/ocm-backplane/cloud/ssm.go — Multi-line CWE-reference comment is more verbose than this file's terse single-line style.
  Remediation: Consider condensing to: // Log non-sensitive session identifier for debugging (credentials excluded).

---

Labels: PR fixes a security bug (CWE-532/CWE-312) in credential logging

Previous run

Review — approve

PR: fix(#8): remove SSM credential logging at Info level
Scope: cmd/ocm-backplane/cloud/ssm.go, cmd/ocm-backplane/cloud/ssm_test.go (2 files, +70/−5)

Summary

Clean, well-scoped security fix that removes credential logging at Info level in runSSMsession. The change correctly addresses CWE-532 (Information Exposure Through Log Files) and CWE-312 (Cleartext Storage of Sensitive Information) as reported in issue #8.

Changes verified

Area	Assessment
Correctness	✅ Three logger.Infof calls for SessionId, StreamUrl, and TokenValue removed. SessionId retained at Debug level (non-sensitive, useful for troubleshooting). StreamUrl and TokenValue completely removed from logging. Session JSON still passed privately to session-manager-plugin via argv — no functional regression.
Security	✅ Directly resolves the credential exposure vulnerability. The error format on line 248 uses %v with *string pointers (prints <nil> or memory addresses, not actual values) — safe. No other SSM credential logging found in the broader codebase.
Test coverage	✅ Three new Ginkgo tests verify that TokenValue, StreamUrl, and SessionId do not appear in log output at Info level. Tests correctly capture logrus output via bytes.Buffer, set level to Info, and check for absence of sensitive strings. AfterEach properly restores log state.
Intent & coherence	✅ Change is minimally scoped to the reported vulnerability. No unrelated modifications. Directly closes #8.
Style	✅ Import reordering follows Go alphabetical convention. Comments include CWE references. Test structure matches existing Ginkgo patterns in the file.
Documentation	✅ Code comments updated with security rationale. No in-repo docs affected.
Cross-repo contracts	N/A — no API, schema, or interface changes.

No findings

No blocking or notable issues identified. The fix is correct, minimal, and well-tested.

[samanthajayasinghe]

/fs-review

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure · Started 4:56 AM UTC · Completed 5:10 AM UTC
Commit: ae64d7c · View workflow run →