[Bug]: A2A and MCP samples log sensitive AP2 payment artifacts in plaintext

[mh-yu]

What happened?

Description

AP2 uses selective disclosure and data minimization so that mandate, token, receipt, and risk data are shared only with roles that need them.

The A2A/MCP samples include debug/request logging paths that can write sensitive payment artifacts to plaintext logs. The Python watch.log helper logs unrecognized data parts verbatim. The Go MPP sample logs full risk_data.

Impact

Exploitation requires access to the generated logs or a downstream logging/export system. The confirmed affected paths are sample implementations.

Logs can expose payment tokens, mandate data, payment receipts, merchant/checkout context, and risk signals to local log readers, centralized logging backends, analytics systems, or support exports.

If a payment_token has bearer or redemption capability, plaintext logging increases the scope for unauthorized use. Even when tokens are scoped or one-time-use, logging weakens AP2's data-minimization and selective-disclosure boundary.

Steps to Reproduce

1. Review docs/ap2/security_and_privacy_considerations.md:116-148. AP2 relies on selective disclosure and data minimization to avoid unnecessary exposure of checkout/payment data.

2. Review code/samples/python/src/common/base_server_executor.py:85-88. The Python sample logs A2A message parts for each request.

3. Review code/samples/python/src/common/watch_log.py:36-40 and :110-119. Only a few mandate keys are excluded; other data parts are logged verbatim.

4. Review code/samples/python/src/roles/credentials_provider_mcp/server.py:244-248 and code/samples/python/src/roles/merchant_agent_mcp/server.py:418-428. The MCP sample returns or forwards payment_token values that can enter request/logging paths.

5. Review code/samples/go/pkg/roles/merchant_payment_processor_agent/executor.go:63-70. The Go sample logs full risk_data with %v.

Relevant log output

Code of Conduct

• I agree to follow this project's Code of Conduct