Data security leak in Telemetry - Githubissues

crewAIInc / crewAI

Framework for orchestrating role-playing, autonomous AI agents. By fostering collaborative intelligence, CrewAI empowers agents to work together seamlessly, tackling complex tasks.

https://crewai.com

MIT License

19.16k stars 2.64k forks source link

Data security leak in Telemetry #1177

Open pjaol opened 1 month ago

pjaol commented 1 month ago

https://github.com/crewAIInc/crewAI/blob/7306414de709d2fff07fe6aa5efd7fe3f99d3c38/src/crewai/telemetry/telemetry.py#L465

Non-optional telemetry data being collected by CrewAI includes base_url which is not a safe variable for private hosted LLM's

This data is collected as part of the _safe_llm_attributes in

tool_usage
tool_repeated_usage
tool_usage_error

without the share_crew attribute check.

Any and all URLs should be treated as secure data due to

possible user name / passwords in URL
private hosted interfaces on custom domains and ports

Related to #266 #372 #241

This should be considered a high risk

joaomdmoura commented 2 weeks ago

Addressed on https://github.com/crewAIInc/crewAI/issues/1178#issuecomment-2319952760