Summary

Fixes an externally-reported security issue: the API key / access token is written to application logs in clear text when DEBUG logging is enabled.

The leak is not in Deepgram's code — it's the third-party websockets library, which logs the full opening handshake at DEBUG, one record per header, via logger.debug("> %s: %s", name, value). That includes Authorization: Token <key>. Any app that turns on DEBUG (common in dev/troubleshooting) then writes the credential to its logs, from where it's easily committed or shipped to a log aggregator.

Fix

Install a logging.Filter on the websockets.client / websockets.server loggers that masks the value of Authorization / Proxy-Authorization headers before the record reaches any handler — so the credential is never emitted, regardless of the app's log level.

• The auth scheme is preserved for debuggability; only the secret is replaced: Authorization: Token [REDACTED].
• Nothing is suppressed and no other log output changes.
• On by default (installed from both client constructors, idempotent). Opt out with DeepgramClient(redact_credentials_in_logs=False) to manage redaction yourself.

Confirmed the filter reliably catches the record: websockets >= 12 (our floor) emits handshake headers directly on websockets.client with no per-connection child loggers, so a filter there sees every header record before propagation.

Files

• src/deepgram/_secure_logging.py — hand-written RedactCredentialsFilter + install/uninstall helpers (frozen in .fernignore)
• src/deepgram/client.py — install from DeepgramClient / AsyncDeepgramClient constructors + opt-out kwarg
• tests/custom/test_secure_logging.py — regression coverage (token masked, scheme preserved, non-sensitive headers untouched, idempotent install, opt-out)

On the per-frame logging

The reporter also noted BINARY ... [N bytes] spam per audio frame. That's also websockets DEBUG output, but it contains no secret (payloads are shown only as byte counts), so it's a verbosity concern, not a disclosure. Silencing it by default would require raising the websockets logger level, which would also drop the handshake debug some users rely on. Recommended app-side mitigation (documented, not forced):

import logging
logging.getLogger("websockets").setLevel(logging.INFO)  # quiet per-frame logs, keep your app at DEBUG

Validation

• ruff check — clean
• mypy — clean
• pytest — 237 passed, 1 skipped (12 new)

🤖 Generated with Claude Code