Prevent debug output from exposing credentials

internal/cli/auth/login.go

@@ -58,7 +58,7 @@ func LoginCmd(h *internal.Helper) *cobra.Command {
 			if err != nil {
 				return err
 			}
-			opts.client.SetDebug(debug)
+			util.ConfigureRestyDebug(opts.client, debug)
 			return nil
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {

internal/cli/auth/logout.go

@@ -21,6 +21,7 @@ import (
 	"github.com/tidbcloud/tidbcloud-cli/internal/config"
 	"github.com/tidbcloud/tidbcloud-cli/internal/config/store"
 	"github.com/tidbcloud/tidbcloud-cli/internal/flag"
+	"github.com/tidbcloud/tidbcloud-cli/internal/util"
 	ver "github.com/tidbcloud/tidbcloud-cli/internal/version"
 
 	"github.com/fatih/color"
@@ -50,7 +51,7 @@ func LogoutCmd(h *internal.Helper) *cobra.Command {
 			if err != nil {
 				return err
 			}
-			opts.client.SetDebug(debug)
+			util.ConfigureRestyDebug(opts.client, debug)
 			return nil
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {

internal/cli/auth/whoami.go

@@ -26,6 +26,7 @@ import (
 	"github.com/tidbcloud/tidbcloud-cli/internal/config/store"
 	"github.com/tidbcloud/tidbcloud-cli/internal/flag"
 	"github.com/tidbcloud/tidbcloud-cli/internal/service/cloud"
+	"github.com/tidbcloud/tidbcloud-cli/internal/util"
 	ver "github.com/tidbcloud/tidbcloud-cli/internal/version"
 
 	"github.com/fatih/color"
@@ -56,7 +57,7 @@ func WhoamiCmd(h *internal.Helper) *cobra.Command {
 			if err != nil {
 				return err
 			}
-			opts.client.SetDebug(debug)
+			util.ConfigureRestyDebug(opts.client, debug)
 			return nil
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {

internal/cli/config/describe.go

@@ -21,6 +21,7 @@ import (
 	"github.com/tidbcloud/tidbcloud-cli/internal"
 	"github.com/tidbcloud/tidbcloud-cli/internal/config"
 	"github.com/tidbcloud/tidbcloud-cli/internal/output"
+	"github.com/tidbcloud/tidbcloud-cli/pkg/tidbcloud/redact"
 
 	"github.com/juju/errors"
 	"github.com/spf13/cobra"
@@ -42,7 +43,7 @@ func DescribeCmd(h *internal.Helper) *cobra.Command {
 				return err
 			}
 
-			value := viper.Get(name)
+			value := redact.MaskAny(viper.Get(name))
 			err = output.PrintJson(h.IOStreams.Out, value)
 			return errors.Trace(err)
 

internal/cli/config/describe_test.go

@@ -54,6 +54,7 @@ func (suite *DescribeConfigSuite) SetupTest() {
 
 	viper.Set("test.public-key", publicKey)
 	viper.Set("test.private-key", privateKey)
+	viper.Set("test.access-token", "raw-access-token")
 	viper.Set("current-profile", profile)
 	err := viper.WriteConfig()
 	if err != nil {
@@ -81,12 +82,12 @@ func (suite *DescribeConfigSuite) TestDescribeConfigArgs() {
 		{
 			name:         "describe config",
 			args:         []string{"test"},
-			stdoutString: "{\n  \"private-key\": \"SDWIOUEOSDSDC\",\n  \"public-key\": \"SDIWODIJQNDKJQW\"\n}\n",
+			stdoutString: "{\n  \"access-token\": \"******\",\n  \"private-key\": \"******\",\n  \"public-key\": \"SDIWODIJQNDKJQW\"\n}\n",
 		},
 		{
 			name:         "describe config case-insensitive",
 			args:         []string{"teSt"},
-			stdoutString: "{\n  \"private-key\": \"SDWIOUEOSDSDC\",\n  \"public-key\": \"SDIWODIJQNDKJQW\"\n}\n",
+			stdoutString: "{\n  \"access-token\": \"******\",\n  \"private-key\": \"******\",\n  \"public-key\": \"SDIWODIJQNDKJQW\"\n}\n",
 		},
 		{
 			name: "describe config with no args",
@@ -126,6 +127,7 @@ func (suite *DescribeConfigSuite) TestDescribeConfigWithSpecialCharacters() {
 
 	viper.Set("~`!@#$%^&*()_+-={}[]\\|;:,<>/?.public-key", publicKey)
 	viper.Set("~`!@#$%^&*()_+-={}[]\\|;:,<>/?.private-key", privateKey)
+	viper.Set("~`!@#$%^&*()_+-={}[]\\|;:,<>/?.access-token", "raw-access-token")
 	viper.Set("current-profile", newProfile)
 
 	err := viper.WriteConfig()
@@ -143,7 +145,7 @@ func (suite *DescribeConfigSuite) TestDescribeConfigWithSpecialCharacters() {
 		{
 			name:         "describe active profile",
 			args:         []string{"~`!@#$%^&*()_+-={}[]\\|;:,<>/?"},
-			stdoutString: "{\n  \"private-key\": \"SDWIOUEOSDSDC\",\n  \"public-key\": \"SDIWODIJQNDKJQW\"\n}\n",
+			stdoutString: "{\n  \"access-token\": \"******\",\n  \"private-key\": \"******\",\n  \"public-key\": \"SDIWODIJQNDKJQW\"\n}\n",
 		},
 	}
 

internal/cli/config/set.go

@@ -21,6 +21,7 @@ import (
 	"github.com/tidbcloud/tidbcloud-cli/internal"
 	"github.com/tidbcloud/tidbcloud-cli/internal/config"
 	"github.com/tidbcloud/tidbcloud-cli/internal/prop"
+	"github.com/tidbcloud/tidbcloud-cli/pkg/tidbcloud/redact"
 
 	"github.com/fatih/color"
 	"github.com/juju/errors"
@@ -61,7 +62,7 @@ If not, the config in the active profile will be set`, prop.ProfileProperties())
 					}
 				}
 				viper.Set(fmt.Sprintf("%s.%s", curP, propertyName), value)
-				res = fmt.Sprintf("Set profile `%s` property `%s` to value `%s` successfully", curP, propertyName, value)
+				res = fmt.Sprintf("Set profile `%s` property `%s` to value `%s` successfully", curP, propertyName, redact.MaskValue(propertyName, value))
 			} else {
 				return fmt.Errorf("unrecognized property `%s`, use `config set --help` to find available properties", propertyName)
 			}

internal/cli/config/set_test.go

@@ -86,7 +86,7 @@ func (suite *SetConfigSuite) TestSetConfigArgs() {
 		{
 			name:         "set config",
 			args:         []string{"private-key", newPrivateKey},
-			stdoutString: "Set profile `test` property `private-key` to value `TYTYTYYTYT` successfully\n",
+			stdoutString: "Set profile `test` property `private-key` to value `******` successfully\n",
 		},
 		{
 			name: "set config with no args",
@@ -158,7 +158,7 @@ func (suite *SetConfigSuite) TestSetConfigWhenNoActiveProfile() {
 		{
 			name:         "set config",
 			args:         []string{"private-key", "value"},
-			stdoutString: "Set profile `default` property `private-key` to value `value` successfully\n",
+			stdoutString: "Set profile `default` property `private-key` to value `******` successfully\n",
 		},
 	}
 

internal/cli/root_test.go

@@ -88,28 +88,28 @@ func (suite *RootCmdSuite) TestFlagProfile() {
 		{
 			name:          "test without flag profile",
 			args:          []string{"config", "set", "private-key", privateKey3},
-			stdoutString:  "Set profile `test` property `private-key` to value `324OPIFO2423423DFO` successfully\n",
+			stdoutString:  "Set profile `test` property `private-key` to value `******` successfully\n",
 			propertyKey:   "test.private-key",
 			propertyValue: "324OPIFO2423423DFO",
 		},
 		{
 			name:          "test flag --profile",
 			args:          []string{"config", "set", "private-key", privateKey1, "--profile", "test1"},
-			stdoutString:  "Set profile `test1` property `private-key` to value `SAJKGDUYAKGD` successfully\n",
+			stdoutString:  "Set profile `test1` property `private-key` to value `******` successfully\n",
 			propertyKey:   "test1.private-key",
 			propertyValue: "SAJKGDUYAKGD",
 		},
 		{
 			name:          "test flag -P",
 			args:          []string{"config", "set", "private-key", privateKey2, "-P", "test1"},
-			stdoutString:  "Set profile `test1` property `private-key` to value `{OPIFOPIDFO` successfully\n",
+			stdoutString:  "Set profile `test1` property `private-key` to value `******` successfully\n",
 			propertyKey:   "test1.private-key",
 			propertyValue: "{OPIFOPIDFO",
 		},
 		{
 			name:          "test flag -P case-insensitive",
 			args:          []string{"config", "set", "private-key", "SADASDIDFO", "-P", "tESt1"},
-			stdoutString:  "Set profile `test1` property `private-key` to value `SADASDIDFO` successfully\n",
+			stdoutString:  "Set profile `test1` property `private-key` to value `******` successfully\n",
 			propertyKey:   "test1.private-key",
 			propertyValue: "SADASDIDFO",
 		},

internal/security/debug_dump_test.go

@@ -0,0 +1,58 @@
+// Copyright 2026 PingCAP, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package security
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestRawHTTPDumpUsageIsCentralized(t *testing.T) {
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("cannot locate test file")
+	}
+	repoRoot := filepath.Clean(filepath.Join(filepath.Dir(file), "../.."))
+	allowed := filepath.Join(repoRoot, "pkg/tidbcloud/redact/redact.go")
+	needles := []string{"httputil." + "DumpRequestOut", "httputil." + "DumpResponse"}
+
+	for _, dir := range []string{"internal", "pkg/tidbcloud"} {
+		root := filepath.Join(repoRoot, dir)
+		err := filepath.WalkDir(root, func(path string, entry os.DirEntry, err error) error {
+			if err != nil {
+				return err
+			}
+			if entry.IsDir() || !strings.HasSuffix(path, ".go") {
+				return nil
+			}
+			content, err := os.ReadFile(path)
+			if err != nil {
+				return err
+			}
+			for _, needle := range needles {
+				if strings.Contains(string(content), needle) && path != allowed {
+					t.Fatalf("raw HTTP dump %q must go through redaction helper, found in %s", needle, path)
+				}
+			}
+			return nil
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+}

internal/service/aws/s3/uploader.go

@@ -20,11 +20,9 @@ import (
 	"fmt"
 	"io"
 	"math"
-	"os"
 	"sort"
 	"sync"
 
-	"github.com/tidbcloud/tidbcloud-cli/internal/config"
 	"github.com/tidbcloud/tidbcloud-cli/internal/service/cloud"
 	"github.com/tidbcloud/tidbcloud-cli/internal/util"
 	"github.com/tidbcloud/tidbcloud-cli/pkg/tidbcloud/v1beta1/serverless/imp"
@@ -163,8 +161,6 @@ type UploaderImpl struct {
 // cloud.TiDBCloudClient.
 func NewUploader(client cloud.TiDBCloudClient) Uploader {
 	httpClient := resty.New()
-	debug := os.Getenv(config.DebugEnv) != ""
-	httpClient.SetDebug(debug)
 	u := &UploaderImpl{
 		PartSize:          DefaultUploadPartSize,
 		Concurrency:       DefaultUploadConcurrency,

internal/service/aws/s3/uploader_debug_test.go

@@ -0,0 +1,33 @@
+// Copyright 2026 PingCAP, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package s3
+
+import (
+	"testing"
+
+	"github.com/tidbcloud/tidbcloud-cli/internal/config"
+)
+
+func TestNewUploaderDoesNotEnableRawRestyDebugForPresignedURLs(t *testing.T) {
+	t.Setenv(config.DebugEnv, "1")
+
+	uploader, ok := NewUploader(nil).(*UploaderImpl)
+	if !ok {
+		t.Fatalf("unexpected uploader type %T", uploader)
+	}
+	if uploader.httpClient.Debug {
+		t.Fatal("raw Resty debug must stay disabled for pre-signed upload URLs")
+	}
+}

internal/service/cloud/api_client.go

@@ -20,12 +20,12 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"net/http/httputil"
 	"os"
 
 	"github.com/tidbcloud/tidbcloud-cli/internal/config"
 	"github.com/tidbcloud/tidbcloud-cli/internal/prop"
 	"github.com/tidbcloud/tidbcloud-cli/internal/version"
+	"github.com/tidbcloud/tidbcloud-cli/pkg/tidbcloud/redact"
 	"github.com/tidbcloud/tidbcloud-cli/pkg/tidbcloud/v1beta1/iam"
 	"github.com/tidbcloud/tidbcloud-cli/pkg/tidbcloud/v1beta1/serverless/auditlog"
 	"github.com/tidbcloud/tidbcloud-cli/pkg/tidbcloud/v1beta1/serverless/br"
@@ -854,7 +854,7 @@ func (dt *DebugTransport) RoundTrip(r *http.Request) (*http.Response, error) {
 	debug := os.Getenv(config.DebugEnv) == "true" || os.Getenv(config.DebugEnv) == "1"
 
 	if debug {
-		dump, err := httputil.DumpRequestOut(r, true)
+		dump, err := redact.DumpRequestOut(r, true)
 		if err != nil {
 			return nil, err
 		}
@@ -867,7 +867,7 @@ func (dt *DebugTransport) RoundTrip(r *http.Request) (*http.Response, error) {
 	}
 
 	if debug {
-		dump, err := httputil.DumpResponse(resp, true)
+		dump, err := redact.DumpResponse(resp, true)
 		if err != nil {
 			return resp, err
 		}