From 83b5d25ded1a5fc83ec2ea71088f94cdd05e3c5e Mon Sep 17 00:00:00 2001
From: 7ttp <117663341+7ttp@users.noreply.github.com>
Date: Fri, 17 Jul 2026 00:50:07 +0530
Subject: [PATCH] fix

---
 .../cli/src/shared/telemetry/tracing.layer.ts |  1 +
 .../telemetry/tracing.layer.unit.test.ts      | 27 +++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/apps/cli/src/shared/telemetry/tracing.layer.ts b/apps/cli/src/shared/telemetry/tracing.layer.ts
index f9638cad11..770a2218ee 100644
--- a/apps/cli/src/shared/telemetry/tracing.layer.ts
+++ b/apps/cli/src/shared/telemetry/tracing.layer.ts
@@ -76,6 +76,7 @@ class ExportableSpan implements Tracer.Span {
   }
 
   attribute(key: string, value: unknown): void {
+    if (key.endsWith(".header.apikey")) return;
     this.attributes.set(key, value);
   }
 
diff --git a/apps/cli/src/shared/telemetry/tracing.layer.unit.test.ts b/apps/cli/src/shared/telemetry/tracing.layer.unit.test.ts
index 25b306e041..d6642f8492 100644
--- a/apps/cli/src/shared/telemetry/tracing.layer.unit.test.ts
+++ b/apps/cli/src/shared/telemetry/tracing.layer.unit.test.ts
@@ -242,6 +242,33 @@ describe("tracingLayer – span behaviour", () => {
     );
   });
 
+  it.live("does not write API keys to trace files", () => {
+    const home = makeTempDir();
+    const tracesDir = path.join(home, ".supabase", "traces");
+    const secretKey = `sb_secret_${"a".repeat(40)}`;
+    return Effect.gen(function* () {
+      const tracer = yield* Tracer.Tracer;
+      const span = tracer.span(makeSpanOptions());
+      span.attribute("http.request.header.apikey", secretKey);
+      span.end(BigInt(Date.now() + 100) * 1_000_000n, Exit.void);
+    }).pipe(
+      Effect.provide(buildTracingLayer({ home })),
+      Effect.ensuring(
+        Effect.sync(() => {
+          try {
+            const traceFile = readdirSync(tracesDir).find((file) => file.endsWith(".ndjson"));
+            expect(traceFile).toBeDefined();
+            const trace = readFileSync(path.join(tracesDir, traceFile!), "utf8");
+            expect(trace).not.toContain(secretKey);
+            expect(trace).not.toContain("http.request.header.apikey");
+          } finally {
+            rmSync(home, { recursive: true, force: true });
+          }
+        }),
+      ),
+    );
+  });
+
   it.live("span end does NOT export to NDJSON when SUPABASE_TELEMETRY_DISABLED=1", () => {
     const home = makeTempDir();
     const configDir = path.join(home, ".supabase");