Password saved in the clear text in the server log.

[cezarsn]

In case of an error of an transaction because of an error in the post request, the hole transaction information including the password and the second passoword is saved on the log of the application. The application should not save user related data into the log.

error 2016-06-05 10:44:06 /api/signatures { [SyntaxError: Unexpected string]
body: '{"--ommited....","secondSecret":"--ommited....","publicKey":"0348axxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
status: 400,
statusCode: 400 }

[staticinstance]

@cezarsn can you give repro steps on this?

[cezarsn]

In case you want to authorise a transfer put in second passphrase a not BIP39 character like '-* or non alphanumeric characters. The request will fail and the POST parameters for the transaction are saved in the log. One of the parameters is the second passphrase.