Remove plaintext bearer token from warning logs #7

New Issue

cal · 2026-02-20T06:51:45Z

cal commented

2026-02-20 06:51:45 +00:00

Pattern `logging.warning(f'Bad Token: {token}')` used in `teams.py`, `gamerewards.py`, `events.py`, and many other routers when auth fails. Full bearer token written to log file. Affects at least 15 router files.

Priority: high

Pattern \`logging.warning(f'Bad Token: {token}')\` used in \`teams.py\`, \`gamerewards.py\`, \`events.py\`, and many other routers when auth fails. Full bearer token written to log file. Affects at least 15 router files. **Priority**: high

cal added the

security

label 2026-02-20 06:51:45 +00:00

cal added the

ai-working

label 2026-03-04 05:01:07 +00:00

cal referenced this issue from a commit

2026-03-04 05:02:14 +00:00

fix: remove plaintext bearer token from warning logs (#7)

cal referenced a pull request that will close this issue

2026-03-04 05:02:30 +00:00

fix: remove plaintext bearer token from warning logs (#7) #55

cal added the

ai-pr-opened

label 2026-03-04 05:02:41 +00:00

cal commented

2026-03-04 05:02:43 +00:00

Fixed in PR #55: #55

Replaced all logging.warning(f'Bad Token: {token}') calls with logging.warning('Bad Token: [REDACTED]') across 30 router files. The f-string was dropped since no interpolation is needed after redacting the token.

Fixed in PR #55: https://git.manticorum.com/cal/paper-dynasty-database/pulls/55 Replaced all `logging.warning(f'Bad Token: {token}')` calls with `logging.warning('Bad Token: [REDACTED]')` across 30 router files. The f-string was dropped since no interpolation is needed after redacting the token.

cal added

ai-failed

and removed

ai-working

labels 2026-03-04 05:02:58 +00:00

cal referenced this issue from a commit

2026-03-05 03:43:31 +00:00

fix: remove plaintext bearer token from warning logs (#7)

cal closed this issue

2026-03-05 03:43:42 +00:00

cal referenced this issue from a commit

2026-03-05 03:43:42 +00:00