Your Lightning Node May Be Logging More Than You Think
A recent Core Lightning change caught my attention: I/O logs were removed from getlog because they could contain runes and other secrets.
That made me look at my node from a different direction.
I normally open logs because something broke. This time I asked what the logs themselves could expose.
And the boundary gets big pretty quickly:
lightningd → plugins → journald → Docker → reverse proxy → monitoring → backups
Then there’s shell history, old snapshots and all the random places logs get copied when we’re debugging something.
I turned the exercise into a practical audit:
https://davidebtc186.substack.com/p/your-lightning-node-may-be-logging
One question I’d be curious to hear from other node operators:
If someone got read-only access to every log produced by your Lightning stack, what would they actually learn?
Write a comment