"Report this error to Cloudflare" -> IP, privacy and security violation?

[zehawki]

What versions & operating system are you using?

wrangler 4.22.0

Please provide a link to a minimal reproduction

No response

Describe the Bug

Wrangler crashes when running and I do [b] open a browser. Wrangler then throws up a question:

If you think this is a bug then please create an issue at https://github.com/cloudflare/workers-sdk/issues/new/choose
√ Would you like to report this error to Cloudflare? Wrangler's output and the error details will be shared with the Wrangler team to help us diagnose and fix the issue. ... yes

Ive answered "yes" to this and then it says

Logs were written to "....wrangler\logs\wrangler-2025-06-30_10-57-04_521.log

I would like to know if (this and similar) log files, as is, is being sent to Cloudflare. If so - this is a major IP, privacy and security violation.

Please provide any relevant error logs

No response

[penalosa]

Thanks for opening this @zehawki. Wrangler has two ways to send details of a session to Cloudflare for analysis:

1. Sentry, which is what you indicated in the issue description. This is completely opt-in, and will only send details of the error (and the logs leading up to the error) if you answer "yes" to the prompt. The purpose of this is to help us diagnose and fix issues with the Wrangler CLI that users are running in to. Wrangler is open source, so you can review the Sentry configuration here: https://github.com/cloudflare/workers-sdk/tree/main/packages/wrangler/src/sentry/index.ts.
2. Telemetry, which has a privacy policy described here: https://github.com/cloudflare/workers-sdk/tree/main/packages/wrangler/telemetry.md. The data sent is described in the telemetry policy, and there's an opt-out setting.

As of writing, we don't upload Wrangler's log files anywhere, although a Sentry report will contain a subset of them (Sentry only receives console output from Wrangler at the currently configured log level, compared to the full debug logs that are present in the log file).

Additionally, Wrangler's debug log file is santised before being written to disk, and so doesn't contain any auth tokens, sensitive API headers, API request body, or API responses unless the WRANGLER_LOG_SANITIZE environment variable is set to false.

[zehawki]

@penalosa thank you very much for the detailed reply, points 1 and 2 that you have mentioned are as expected, and normal.

My worry is with the actual log file. I looked at it and I saw that it contains

1. my entire worker code, fully reproduced, multiple times!
2. At least 1 token (cf-workers-preview-token) - IDK how important this could be for replay attacks if exposed (WRANGLER_LOG_SANITIZE is not false, ie left to default value)
3. Names of other scripts which had breakpoints set - and those are not even germane to the current issue

You might agree that my point 1 is really alarming, IF this log file were to be uploaded somewhere - but you've already mentioned "As of writing, we don't upload Wrangler's log files anywhere" - so that takes care of this concern.

However may I suggest not serializing code (which is company IP) to a log file - there are just so many issues with this.

Sentry, which is what you indicated in the issue description. This is completely opt-in, and will only send details of the error (and the logs leading up to the error)
although a Sentry report will contain a subset of them (Sentry only receives console output from Wrangler at the currently configured log level, compared to the full debug logs that are present in the log file)

If its only console output, then of course its fine. But here also, perhaps you can ensure that user code is not getting inadvertently send off somewhere.

[petebacondarwin]

1. Your Worker code would be uploaded to Cloudflare on deployment; this is part of your agreement by using Cloudflare. These log files are controlled by you. We do not automatically do anything with them. Is the concern that you might accidentally run Wrangler in an insecure environment where these log files could be leaked?
2. Do these tokens get written if WRANGLER_LOG_SANITIZE is not false? The default it to sanitize so you have to actively opt-in for these to be written to the logs.
3. Can you elaborate on this point? Are these other files part of your Worker?

[zehawki]

1. Your Worker code would be uploaded to Cloudflare on deployment; this is part of your agreement by using Cloudflare.

Yes that's obvious... without that there is no point in using Workers 😉. I am not referring to this flow at all.

I am referring to Worker code being written into a log file, and then:

1. Either being uploaded partly as mentioned above "will only send details of the error (and the logs leading up to the error)" Emphasis mine.
2. "accidentally run Wrangler in an insecure environment where these log files could be leaked" -> Yes, log files just sitting around on a dev's machine with code inside - thats just a needless attack vector

2. Do these tokens get written if WRANGLER_LOG_SANITIZE is not false

I see that I have made a typo above, which I have now corrected. Sorry about that. It should be: WRANGLER_LOG_SANITIZE is not false, ie left to default value.

To be unambiguous, at various points the log says:

HEADERS: omitted; set WRANGLER_LOG_SANITIZE=false to include sanitized data

However, I can see at least 1 token still being logged: cf-workers-preview-token, in the one log that I am looking into, and there are 100s of logs.

3. Can you elaborate on this point? Are these other files part of your Worker?

No they are not - they are completely separate workers, which were not even running in wrangler at the time this worker was in dev.

[requestmethod]

1. Sentry, which is what you indicated in the issue description. This is completely opt-in, and will only send details of the error (and the logs leading up to the error) if you answer "yes" to the prompt. The purpose of this is to help us diagnose and fix issues with the Wrangler CLI that users are running in to. Wrangler is open source, so you can review the Sentry configuration here: https://github.com/cloudflare/workers-sdk/tree/main/packages/wrangler/src/sentry/index.ts.

Would you consider a config setting to allow us to set the default value to "no" so we never see the prompt at all?