DocsBook a demo

Platform

Platform overviewArchitectureWorkflow orchestrationGitOps configurationGovernance and AAAAI and MCPKnowledge and contextRuntime and executionEvidence and monitoring

Use cases

All use casesProduction incidentRelease preparationHotfix to productionSecurity scan triage
Why NopsAIIntegrationsSecurity

Resources

All resourcesAI agent governanceMCP governanceMCP securitySelf-hosted platforms
PricingGitHub

Company

How a run worksAboutContactBook a demo

Pipeline logs and redaction

Durable run records, what is masked, and what is deliberately left visible.

ReferenceOperatorSecurity

Key points

  • Pipeline logs are durable run records, distinct from live System Logs.
  • Agent-side masking covers declared secrets, sensitive variable names, and outputs marked sensitive.
  • Non-sensitive operational evidence — environment names, versions, image references, change IDs, declared non-sensitive output JSON — stays visible for troubleshooting and release review.
  • Durable ingestion applies best-effort credential-pattern redaction, including escaped JSON inside agent log messages, before writing pipeline_run_logs.

Examples

Read run logs, including a child pipelinebash
curl -s -H "Authorization: Bearer $NOPSAI_TOKEN" "$NOPSAI_URL/v1/runs/$RUN_ID/logs" \
  | jq -r '.[] | "\(.timestamp) \(.step_name // "-") \(.line)"' | tail -40
Result

Log records carry the text under line, with the step and task that produced it. Declared secrets and sensitive outputs arrive already masked.

How it works

The distinction matters when investigating a leak: agent-side masking is intentional and driven by your declarations, while ingestion-side redaction is a best-effort safety net. Declaring a value as a secret or sensitive output is the reliable control.

If a value you expected to be masked appears in logs, check whether it was declared under secrets or marked sensitive: true on the producing output.

Implementation evidence

  • services/nopsai/routes.go

    Run log read and ingest routes.