Filter sensitive values from being logged in ProcessProxy

enterprise_gateway/services/processproxies/processproxy.py

@@ -518,7 +518,27 @@ async def launch_process(self, kernel_cmd: str, **kwargs: dict[str, Any] | None)
 
         self._enforce_authorization(**kwargs)
 
-        self.log.debug("BaseProcessProxy.launch_process() env: {}".format(kwargs.get("env")))
+        # Filter sensitive values from being logged
+        sensitive_env = kwargs.get("sensitive_env")
+        if sensitive_env is None:
+            sensitive_env = [
+                "pwd",
+                "password",
+                "secret",
+                "token",
+                "key",
+                "code",
+                "auth",
+                "state",
+                "xsrf",
+            ]
+
+        env_copy = kwargs.get("env").copy()
+        for key in list(env_copy):
+            if any(phrase in key.lower() for phrase in sensitive_env):
+                env_copy[key] = "[secret]"
+
+        self.log.debug(f"BaseProcessProxy.launch_process() env: {env_copy}")
 
     def launch_kernel(
         self, cmd: list[str], **kwargs: dict[str, Any] | None