[yeongseon]

Summary

Add an opt-in fail-closed secure redaction preset without expanding the eight-keyword setup_logging() API.

Changes

• Call configure_secure_redaction() after logging/exporter setup to protect current root/named handlers; explicitly disable with enabled=False.
• Preserve all eight setup keywords and default behavior. Ordinary setup cannot silently disable an explicitly selected secure policy.
• Support late handlers with attach_secure_redaction(), bounded conversion/traversal, sanitized exceptions and downstream JSON/OTel canary tests.
• Retain fixes for Basic authorization, structured interpolation, textual record metadata and quoted credentials.
• Document ordering, late-handler limits and trade-offs. The separate preset follows the existing API-ceiling rule rather than amending it.

Validation

• The new signature regression failed with nine keywords before the redesign and passed with eight afterwards.
• Python 3.11.15 make check-all and make build passed before integration of the concurrent credential-regression commit and latest main: 942 passed, 4 skipped, 4 deselected, 13 warnings in 10.81s; coverage 96.43%.
• That local result is not claimed for the final integrated head. Exact-head GitHub CI remains required before merge.
• Local LSP diagnostics could not run because the tool rejects paths outside the session workspace; repository mypy passed.
• No live Azure deployment/ingestion was run. Local Functions host/Azurite smoke was not rerun for this redesign.

Related Issues

Refs #615

Merge authorized by the maintainer's explicit instruction, subject to exact-head required CI and resolved review conversations.

[Copilot]

🟡 Changes recommended

Verified credential leaks remain in the secure sanitization paths and must be addressed before approval.

4 open issues

• Mask Basic authorization credentials in secure mode · New
• Mask structured logging arguments before interpolation · New
• Mask credential-bearing logger and thread metadata · New
• Mask quoted credential representations in secure mode · New

What changed in this PR

Adds an opt-in secure redaction profile to the library’s logging pipeline while preserving existing defaults. This covers the runtime and documentation portion of #615; security automation remains separate.

Changes:

• Adds fail-closed sanitization with bounded traversal and guarded value conversion.
• Integrates secure filtering with current handlers and exposes a helper for late handlers.
• Adds canary tests and documents configuration, ordering, compatibility, and limits.

File	Description
tests/​test_secure_sinks.py	Tests OTel export, capture, and concurrent reconfiguration.
tests/​test_secure_setup.py	Tests handler installation, ordering, and reconfiguration.
tests/​test_secure_redaction.py	Tests fail-closed conversion and diagnostic handling.
tests/​test_secure_limits.py	Tests traversal limits, credential patterns, and benign values.
tests/​test_public_api.py	Adds the new helper to expected exports.
tests/​test_integration.py	Updates public export assertions.
src/​azure_functions_logging/​_setup.py	Adds and applies the redaction preset.
src/​azure_functions_logging/​_secure.py	Implements secure filter ownership and attachment.
src/​azure_functions_logging/​_secure_values.py	Adds bounded value sanitization.
src/​azure_functions_logging/​_secure_record.py	Sanitizes record extras, messages, and diagnostics.
src/​azure_functions_logging/​_filters.py	Adds the opt-in fail-closed filter path.
src/​azure_functions_logging/​__init__.py	Exports attach_secure_redaction.
README.md	Introduces secure production setup.
llms.txt	Updates concise API guidance.
llms-full.txt	Documents secure APIs and behavior.
docs/​opentelemetry.md	Explains secure exporter call order.
docs/​configuration.md	Documents setup, compatibility, and protection limits.
docs/​api.md	Adds the handler attachment API reference.
DESIGN.md	Records the opt-in secure redaction design.

_{Review effort: Balanced}

[yeongseon]

Validated all four review findings with synthetic protected-handler regressions: Basic authorization (including diagnostics), structured formatting arguments, textual logger/thread metadata, and quoted assignments/mapping representations all leaked before the fix. Fixed secure-only pattern ordering/coverage, sanitized structured arguments before interpolation while retaining numeric types and existing conversion-failure behavior, and masked sink-visible textual metadata. Full local make check-all and make build passed on Hatch Python 3.11.15: 950 passed, 4 skipped, 4 deselected, 13 warnings in 13.63s; coverage 96.37%. Skips: two Python >=3.12 features and two unavailable azure_functions_worker imports. Live Azure ingestion was not run. LSP cannot access the out-of-workspace private worktree; repository mypy passed. Merge remains blocked pending exact-head CI, current-head review, and the human authorization required by docs/review-evidence-policy.md. Also unresolved: CONTRIBUTING.md prohibits a ninth standalone setup_logging keyword; the current redaction keyword needs the documented profile/preset design decision, not an implicit exception.

[yeongseon]

The eight-keyword blocker is fixed at 4f68841: configure_secure_redaction() is a separate explicit preset, setup_logging retains its original eight keywords, and ordinary setup does not disable secure redaction. The signature regression was observed red before the change. Documentation and downstream secure tests use the new API. Concurrent commit d4cbfd7 and latest main were merged without discarding their intent. All four credential-leak review threads are resolved. Local make check-all/build passed before those integrations (exact summary and scope in body); final-head CI is pending, not claimed green. Merge authorized by the maintainer’s explicit instruction, conditional on exact-head green required contexts.

[yeongseon]

Final exact-head review: 4f68841 has successful bandit, semgrep, Analyze, PR title and ci-required checks, including wheel and real local Functions host smoke. All four review threads are resolved; branch is CLEAN. The completed PR title run is successful; an earlier duplicate run was cancelled and is not treated as evidence. The separate secure preset preserves eight setup keywords and explicit disable semantics. Merge authorized by the maintainer’s explicit instruction. Refs #615 remains because the tracker includes broader baseline evidence.