Severity: medium
Type: security
Location: clipsync/clipboard.py — ClipboardSync._out_loop() heartbeat log (~line 965); clipsync/debug.py — LogMirror._tick() (~line 100)
Problem: When CLIPSYNC_LOG_LEVEL=DEBUG is set, the heartbeat prints the first 40 characters of _last_synced, which may be clipboard text. LogMirror then copies the log into the shared sync folder, so every peer receives snippets of the local clipboard in debug/{hostname}.log.
Suggested fix: Redact or omit the content from the heartbeat log; log only the type and length of last_synced. Also consider encrypting mirrored logs when encryption is enabled.
Filed from a full-source audit of the repo (2026-07-29). Reported by the audit but not independently confirmed - verify the cited code before acting on it.
Severity: medium
Type: security
Location:
clipsync/clipboard.py—ClipboardSync._out_loop()heartbeat log (~line 965);clipsync/debug.py—LogMirror._tick()(~line 100)Problem: When
CLIPSYNC_LOG_LEVEL=DEBUGis set, the heartbeat prints the first 40 characters of_last_synced, which may be clipboard text.LogMirrorthen copies the log into the shared sync folder, so every peer receives snippets of the local clipboard indebug/{hostname}.log.Suggested fix: Redact or omit the content from the heartbeat log; log only the type and length of
last_synced. Also consider encrypting mirrored logs when encryption is enabled.Filed from a full-source audit of the repo (2026-07-29). Reported by the audit but not independently confirmed - verify the cited code before acting on it.