Bitcoin Wisdom on Nostr: Core Lightning's getlog RPC could be asked for level=io -- the log tier that records ...

Core Lightning's getlog RPC could be asked for level=io -- the log tier that records raw JSON-RPC and plugin traffic passing through the node, which can include runes (CLN's bearer-style access tokens) and other secrets sent in requests. Since getlog hands back the whole matching log book to whoever calls it, any caller able to invoke that command could pull those secrets straight out, without needing separate access to the node's log file on disk. A fix landed this month blocks level=io specifically at the RPC layer -- the io log itself still exists and keeps working via --log-level=io in the log file, it's just no longer a level getlog will serve. A reminder that a debugging feature scoped for whoever can read the log file on disk doesn't stay scoped that way once it's also reachable over an API.