fix: redact 2FA code from homebridge-ui server log#1746
Merged
dgreif merged 1 commit intoMay 21, 2026
Conversation
The homebridge-ui server logs the 2FA code in plaintext on token exchange. Codes are short-lived and single-use, but logs are frequently shared in bug reports/screenshots, so removing the value from the log is a small defensive improvement. The email is kept so the existing "we're at the token-exchange step" signal is preserved.
🦋 Changeset detectedLatest commit: 3305c8e The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
dgreif
approved these changes
May 21, 2026
Owner
dgreif
left a comment
dgreif
left a comment
There was a problem hiding this comment.
I agree that we shouldn't be logging this. Thanks for suggesting the change
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The homebridge-ui plugin server logs the user's 2FA code in plaintext at
packages/homebridge-ring/homebridge-ui/server.ts:62when exchanging it for a refresh token:Ring's 2FA codes are short-lived (~10 min) and single-use, so the practical risk is bounded — but homebridge logs are frequently pasted into bug reports, GitHub issues, and Discord screenshots. Anyone watching the log in that window could replay the code before it expires.
This PR drops
with code ${code}from the log statement. The email is kept so the "we're at the token-exchange step for this user" signal is preserved for debugging.Changes
homebridge-ring/homebridge-ui/server.tshomebridge-ring)Test plan
npx turbo run lint test --filter=homebridge-ring --filter=ring-client-api— all 18 tests pass, lint cleancodeis still destructured and passed togetAuth(code)on the following line, so the unused-var lint rule isn't triggered and behavior is unchanged