-
Notifications
You must be signed in to change notification settings - Fork 5
Closed
Description
Description
When debug mode is enabled, the startup config dump logs Lftp.remote_password in plaintext to the container logs:
DEBUG - seedsync - Config:
...
Lftp.remote_password: <actual password visible here>
...
This is a security concern because:
- Container logs are often collected by logging aggregators (Loki, CloudWatch, etc.)
docker logs seedsyncexposes the password to anyone with Docker access- Log files may persist on disk and be included in bug reports
Expected behavior
The password should be masked in log output, e.g.:
Lftp.remote_password: ********
Steps to reproduce
- Enable debug mode in Settings
- Restart the container
- Run
docker logs seedsync - Password is visible in the config dump
Suggested fix
Mask sensitive fields (remote_password) in the config debug output.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels