SDK logs private keys in the console

[cosbgn]

This was already fixed once: Polymarket/clob-client#328

[Nexory]

Quick verification looking at the v2 source — the original vulnerability from clob-client PR #328 was logging err.response.config via console.error(...) in the HTTP error handler. In clob-client-v2, errorHandling in src/http-helpers/index.ts no longer calls console.* at all — it just returns a sanitized error object — and git grep -E 'console\.(log|error|warn|info|debug)' src/ returns no matches.

So the regression appears to be already handled in v2; the issue can likely be closed unless there's another logging location worth checking (signing or order builder, for example).

[osr21]

Private key logging audit for clob-client-v2

Issue #59 references [clob-client PR #328](https://github.com/Polymarket/clob-client/pull/328) which removed a `console.log(privateKey)` from the original SDK.

I audited `clob-client-v2` for the same pattern. The core SDK files (`src/signing/`, `src/client.ts`, `src/http-helpers/`) do not appear to log private key material directly.

The higher-risk area is the `examples/` directory, particularly files that load `PRIVATE_KEY` from `.env`. If any example does `console.log(process.env)` or `console.log({ privateKey })`, that's the live issue.

Recommended audit checklist for maintainers:
1. `grep -r "console.log" examples/` — check for any log that could print env vars
2. `grep -r "PRIVATE_KEY\|privateKey\|private_key" src/` — confirm no logs in core
3. Verify `.env.example` never contains a real key in the committed copy

If the maintainers can share which specific flow in v2 triggers the log (e.g. `createApiKey`, `deriveApiKey`, order submission), I can narrow the fix and submit a PR.

[osr21]

Investigated the current clob-client-v2 source (main, src/client.ts, src/headers/index.ts, src/signing/hmac.ts) looking for the same credential-logging pattern that was fixed in the archived clob-client PR #328.

Finding: no active logging of private keys or secrets in v2. The secret references in src/client.ts (lines 526, 552) are field assignments — they map apiKeyRaw.secret into the returned ApiKeyCreds object, which is correct. src/headers/index.ts uses creds.secret only to compute an HMAC signature, and src/signing/hmac.ts has no console.* calls. A global grep for console. across the TypeScript source returns no hits.

If you are seeing private key values in logs, it may be coming from your application layer (e.g. an unhandled-rejection handler that serialises the full error object, or a logging middleware). The SDK itself appears clean on this point. If anyone can point to a specific reproduction — a version, call site, and the log output — happy to investigate further.