[yhuiYH]

Motivation

We don't want to save all env vars, in case there are sensitive keys set

Technical Details

Identify if env var contains a sensitive keyword. Exclude from saving it into the DB if included in the list.
This is not an exhaustive list. We can add more keywords to the list over time.

Issue Tracking

JIRA ID: AIPROFSDK-1050

Test Plan

N/A

Test Result

N/A

Submission Checklist

• Look over the contributing guidelines at https://github.com/ROCm/rocm-systems/blob/develop/CONTRIBUTING.md.

[therock-pr-bot]

✅ All Policy Checks Passed

Check	Status	Details
📝 PR Description	✅ Pass	—
⛔ Forbidden Files	✅ Pass	—
🧪 Unit Test	⚠️ Warning	Error: Source/code files changed without an accompanying unit test. Expected: add at least one test file named like test_<name>.py / test_<name>.cpp (or <name>_test.*). Current: code file(s) changed: projects/rocprofiler-sdk/source/lib/output/generateRocpd.cpp; no test file found
🚫 Draft PR	🔜 To Be Enabled	—
🚩 Feature Flag	🔜 To Be Enabled	—
📊 Code Coverage	🔜 To Be Enabled	—

🎉 All policy checks passed!

📖 Need help? See the Policy FAQ for details on every check and how to fix failures.

🙋 Wish to Override Policy?

[Copilot]

Pull request overview

This PR updates rocprofiler-sdk’s rocpd output generation to avoid persisting potentially sensitive environment variables by filtering env var names against a keyword list before serializing them into the DB “environment” JSON field.

Changes:

• Add a keyword-based filter to exclude env vars whose names appear potentially sensitive (case-insensitive substring match).
• Log when an env var is excluded due to the sensitive-keyword filter (instead of storing it in the JSON persisted to DB).

Suppressed comments (1)

projects/rocprofiler-sdk/source/lib/output/generateRocpd.cpp:1323

• This branch claims the env var was "sanitized" due to a semi-colon, but the value is not actually modified and the variable is not written to the JSON (and thus not stored). Update the message to reflect the actual behavior (excluded/skipped), or implement real sanitization.

                    else if(eval.find(';') != std::string::npos)
                    {
                        ROCP_INFO << fmt::format(
                            "Env variable {} was sanitized due to semi-colon in the value", evar);
                    }

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Code Coverage Report

Code Coverage Report

Tests Only

Samples Only

Tests + Samples

[bgopesh]

we can add few more maybe:

access_key
access_token
authorization
bearer
client_secret
encryption_key
session_key
signing_key
ssh_key

[yhuiYH]

we can add few more maybe:

access_key access_token authorization bearer client_secret encryption_key session_key signing_key ssh_key

Since we already included key, token, auth and secret, all those should be flagged as sensitive already and excluded. The only new one is bearer and I can include that.

[MythreyaK]

maybe HEADER(s) too? e.g., ANTHROPIC_CUSTOM_HEADERS

[systems-assistant]

TheRock Submodule Bump Activity

Newest first

• 2026-09-21 — Included in TheRock via ROCm/TheRock#8378.