In _http_manager.py, the request/response header debug logs are gated behind log_requests: both branches of _log_request, and the "Response headers" line in _handle_response. But _check_status_code logs the full response body at DEBUG on every non-200 response, unconditionally:
def _check_status_code(self, response, method, path, params):
if response.status_code != 200:
...
self.logger.debug(f"Response text: {response.text}")
raise FailedRequestError(...)
Because this line is not behind log_requests, a consumer that sets log_requests=False (or never sets it) still gets the response body dumped at DEBUG on any non-200, and can only silence it by raising the pybit logger's level rather than through log_requests. That is inconsistent with the other request/response debug logging, and the body can contain sensitive account data on some endpoints.
Could this line be gated behind log_requests like the others?
Version: pybit 5.16.0
In
_http_manager.py, the request/response header debug logs are gated behindlog_requests: both branches of_log_request, and the "Response headers" line in_handle_response. But_check_status_codelogs the full response body at DEBUG on every non-200 response, unconditionally:Because this line is not behind
log_requests, a consumer that setslog_requests=False(or never sets it) still gets the response body dumped at DEBUG on any non-200, and can only silence it by raising the pybit logger's level rather than throughlog_requests. That is inconsistent with the other request/response debug logging, and the body can contain sensitive account data on some endpoints.Could this line be gated behind
log_requestslike the others?Version: pybit 5.16.0