redact the core credentials from the bwt debug log
What the developer wrote
Authored by Craig Raw
redact the core credentials from the bwt debug log
What changed, and why it matters
This commit fixes a privacy/security issue where Sparrow Wallet's debug log could accidentally record the username and password used to connect to a Bitcoin Core node. When debug logging was enabled, the app printed the full internal configuration of a component called bwt, including the 'bitcoind_auth' field that contained the user's Core RPC credentials. The patch now replaces that credential with '*****' before writing it to the log. This reduces the risk that sensitive credentials leak into log files, which could then be exposed when users share logs for troubleshooting.
Users who previously ran Sparrow with debug logging enabled should review and delete or sanitize any saved debug logs before sharing them, since old logs may still contain the 'bitcoind_auth' credential. Developers should consider extending this redaction pattern to any other logged fields that may contain secrets, and ensure that third-party log aggregation or crash reporting tools do not capture debug logs by default.
Security signals we found
Credential exposure in debug logging
Sensitive configuration field logged in plaintext
Redaction of RPC authentication token
Conditional debug logging to avoid unnecessary serialization
Evidence from the diff
In Bwt.java, the start() method previously serialized the BwtConfig object to JSON via Gson and logged the entire string at DEBUG level. Because bwtConfig includes a ‘bitcoind_auth’ field holding the Bitcoin Core RPC authentication string, debug logs could capture these credentials in plaintext. The patch changes the logging path so it only runs when debug logging is enabled, converts the config to a JsonObject, overwrites the ‘bitcoind_auth’ value with a redacted placeholder, and logs the sanitized object. The actual JSON passed to NativeBwtDaemon.start() remains unchanged, preserving functionality. A submodule reference in ‘lark’ was also updated, but no diff content is provided for it.
Changed components
src/main/java/com/sparrowwallet/sparrow/net/Bwt.javaBitcoin Core RPC authentication flow via bwtDebug log outputInspect captured patch +9 / −2
### lark
@@ -1 +1 @@
-Subproject commit ddffe556f0d1ba6a138be3b362ce74219fed0710
+Subproject commit d4fdf4dac185cef22b4446ab33734f9fab99fdf2
### src/main/java/com/sparrowwallet/sparrow/net/Bwt.java
@@ -2,6 +2,7 @@
import com.google.common.net.HostAndPort;
import com.google.gson.Gson;
+import com.google.gson.JsonObject;
import com.google.gson.annotations.SerializedName;
import com.sparrowwallet.drongo.KeyPurpose;
import com.sparrowwallet.drongo.Network;
@@ -204,7 +205,13 @@ private void start(Collection<String> outputDescriptors, Collection<String> addr
Gson gson = new Gson();
String jsonConfig = gson.toJson(bwtConfig);
- log.debug("Configuring bwt: " + jsonConfig);
+ if(log.isDebugEnabled()) {
+ JsonObject loggedConfig = gson.toJsonTree(bwtConfig).getAsJsonObject();
+ if(loggedConfig.has("bitcoind_auth")) {
+ loggedConfig.addProperty("bitcoind_auth", "*****");
+ }
+ log.debug("Configuring bwt: " + loggedConfig);
+ }
NativeBwtDaemon.start(jsonConfig, callback);
}Why this scored 49/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.