Census API key leaks into INFO logs from geoinfo_from_params

[jinskeep-morpc]

Summary

morpc_census.geos.geoinfo_from_params adds the Census API key to the request parameters, then logs them at INFO level:

# morpc_census/geos.py:489-491 (main)
if k := _get_api_key():
    params['key'] = k
logger.info(f"Getting GEOIDS from {url} and params: {params}.")

INFO is the default level in MORPC workflow notebooks, so every call writes the key into cell output. The hierarchical geography lookup, used for place-county parts (155) and place/remainder parts (070) since 0.6.3/0.6.4, calls this function once per place or county subdivision. One run can therefore write the key thousands of times into a notebook's saved outputs and HTML export, and those get committed.

The exposed Census API key should be rotated. Request a new one at https://api.census.gov/data/key_signup.html and update CENSUS_API_KEY in .env. Copies of the old key remain in git history.

Other places the key can leak

• doc/02-morpc-census-demo.ipynb: committed cell outputs currently contain the key (added May 2026).
• CensusAPI._fetch_group builds the full request URL, including key=, and passes it to morpc.req.get_text_safely. morpc logs that URL at DEBUG, and on errors. Tracked in Census API key leaks into logs and exception messages from morpc.req morpc-py#206.
• Any failed request surfaces morpc's HTTPError, whose message has included the full URL since morpc 0.7.3 (Census API key leaks into logs and exception messages from morpc.req morpc-py#206).

Proposed fix

• Log the request parameters without the key. For example, add the key only to the dict passed to get_json_safely, or redact it in the log message, or use a shared redaction helper from morpc once Census API key leaks into logs and exception messages from morpc.req morpc-py#206 lands.
• Consider logging the per-place geoinfo requests at DEBUG, since hundreds of them per call are noise at INFO.
• Clear or re-run the outputs of doc/02-morpc-census-demo.ipynb so the current file no longer contains the key.
• Test: with CENSUS_API_KEY set to a sentinel value, run geoinfo_from_params (with get_json_safely mocked) and assert the sentinel never appears in captured logs.

🤖 Generated with Claude Code