From 7c25b8384cb377728f3b4d8795345483264896d9 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sat, 22 Aug 2026 08:08:13 -0700 Subject: log: redact secret and otpsecret from request bodies Extend the request-log redaction set beyond password/confirm so NWC connection secrets and TOTP seeds never reach the req/res logs. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01XiwgmQKwKnRxUmVDd4xSf7 --- lib/app.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib') diff --git a/lib/app.ts b/lib/app.ts index 1a2102bd..3b00c702 100644 --- a/lib/app.ts +++ b/lib/app.ts @@ -24,7 +24,7 @@ const resLogger = pino(pino.destination("res")); // Never log plaintext passwords. Redact password fields from request bodies // before they reach the request log. -const REDACT_FIELDS = ["password", "confirm"]; +const REDACT_FIELDS = ["password", "confirm", "secret", "otpsecret"]; const redactBody = (body: any) => { if (!body || typeof body !== "object") return body; const copy: any = { ...body }; -- cgit v1.2.3