fix: redact sensitive information from log output (#12271)

* fix: redact sensitive information from log output

Mask or remove API keys, passwords, tokens, auth settings, and
configuration values from logger calls and print statements to prevent
clear-text exposure of credentials in logs.

* fix: address code review feedback on sensitive info redaction

- Restore full API key display in Windows fallback banner (masking
  defeated the purpose of showing the key for the only time)
- Revert test helper masking in locust setup (developers need full
  credentials for load testing)
- Add missing await on logger.adebug in agentic_mcp
- Remove redundant duplicate log line in openai_responses

* fix: replace unnecessary dict comprehension with dict() call

---------

Co-authored-by: Janardan Singh Kavia <janardankavia@ibm.com>

src/backend/base/langflow/__main__.py

@@ -319,7 +319,7 @@ def run(
                 settings_service.set(arg, values[arg])
             elif hasattr(settings_service.auth_settings, arg):
                 settings_service.auth_settings.set(arg, values[arg])
-            logger.debug(f"Loading config from cli parameter '{arg}': '{values[arg]}'")
+            logger.debug("Loading config from cli parameter '%s'", arg)
 
         # Get final values from settings
         host = settings_service.settings.host

src/backend/base/langflow/api/utils/mcp/agentic_mcp.py

@@ -322,7 +322,7 @@ async def initialize_agentic_user_variables(user_id: UUID | str, session: AsyncS
 
         # Create a dict with agentic variable names and default values as empty strings
         agentic_variables = dict.fromkeys(AGENTIC_VARIABLES, DEFAULT_AGENTIC_VARIABLE_VALUE)
-        logger.adebug(f"Agentic variables: {agentic_variables}")
+        await logger.adebug(f"Agentic variables: {list(agentic_variables.keys())}")
 
         existing_vars = await variable_service.list_variables(user_id, session)
 

src/backend/base/langflow/api/utils/mcp/config_utils.py

@@ -382,8 +382,8 @@ async def auto_configure_starter_projects_mcp(session):
                 # Set up THIS USER'S starter folder authentication (same as new projects)
                 # If AUTO_LOGIN is false, automatically enable API key authentication
                 default_auth = {"auth_type": "none"}
-                await logger.adebug(f"Settings service auth settings: {settings_service.auth_settings}")
-                await logger.adebug(f"User starter folder auth settings: {user_starter_folder.auth_settings}")
+                await logger.adebug("Settings service auth settings: [REDACTED]")
+                await logger.adebug("User starter folder auth settings: [REDACTED]")
                 if (
                     not user_starter_folder.auth_settings
                     and settings_service.auth_settings.AUTO_LOGIN

src/backend/base/langflow/api/v1/openai_responses.py

@@ -74,7 +74,7 @@ async def run_flow_for_openai_responses(
     context = {}
     if variables:
         context["request_variables"] = variables
-        await logger.adebug(f"Added request variables to context: {variables}")
+        await logger.adebug(f"Added request variables to context: {list(variables.keys())}")
 
     # Convert OpenAI request to SimplifiedAPIRequest
     # Note: We're moving away from tweaks to a context-based approach
@@ -88,7 +88,7 @@ async def run_flow_for_openai_responses(
 
     # Context will be passed separately to simple_run_flow
 
-    await logger.adebug(f"SimplifiedAPIRequest created with context: {context}")
+    await logger.adebug(f"SimplifiedAPIRequest created with context keys: {list(context.keys())}")
 
     # Use session_id as response_id for OpenAI compatibility
     response_id = session_id
@@ -619,7 +619,6 @@ async def create_response(
 
     await logger.adebug(f"All headers received: {list(http_request.headers.keys())}")
     await logger.adebug(f"Extracted global variables from headers: {list(variables.keys())}")
-    await logger.adebug(f"Variables dict: {variables}")
 
     # Validate tools parameter - error out if tools are provided
     if request.tools is not None: