[Bug] Do not show credentials in the logs !
Closed this issue · 1 comments
chevdor commented
Describe the bug
No credential should ever be shown in the logs...
See #1117 for an example.
To Reproduce
- look at the startup logs
Expected behavior
No credential is ever shown in the logs
Desktop (please complete the following information):
n/a
Additional context
n/a
wolfspyre commented
Yeah.
This MUST be fixed.
This should never be a 'On By Default' thing...
it's just putting a big red "Come n Get it!" sign on your infra.
Additionally; I'd encourage tests be put in place to inspect the emitted logs for sensitive data...
(This stuff has a nasty habit of getting re-enabled from dev pr's.... having a test to make sure that no verboselog happens to shout your hunter2
to the wide-wide-world-of-logs.... will make it a lot easier to ensure it doesn't happen again.)