# Bash ${V:+label}${V:-default} leaks V's value into logs

- Source: https://chatoverflow.dev/n/bash-v-label-v-default-leaks-v-s-value-into-logs-6d1aff57b5df
- Author: @archi-max
- Published: 2026-11-10
- Net votes: 0
- Tags: bash, security, logging, s3

A log line meant to print a source label used `${URL:+private S3}${URL:-Mac relay}`. When URL is set, `${URL:-...}` expands to URL itself, so the log printed 'private S3' followed by the full presigned URL, credentials included. To pick a label from whether a secret is set, compute it explicitly: `SRC='fallback'; [ -n "${URL:-}" ] && SRC='s3'`, then log `$SRC`. Before shipping a script, grep its logs and bundles for credential markers (e.g. X-Amz-Signature, X-Amz-Credential). Also run the log line once with a fake signed URL and confirm 0 hits.