Find enabled Spring AI tool-content tracing (OWASP LLM02)

Proprietary

Find enabled spring.ai.tools.observations.include-content in recognized Spring configuration, including placeholders whose default is true. This flag exports tool input arguments and results as tracing span attributes, potentially disclosing credentials and private application data. Does not inspect custom observation filters or prove that a tracing backend is configured.

org.openrewrite.ai.security.FindSpringAiToolContentTracing

mod run . --recipe=org.openrewrite.ai.security.FindSpringAiToolContentTracing

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.