Critical security fix. The 3 Trace-level log statements at auth_service.go:117/123/130 were printing JWT tokens and HMAC signing secrets in cleartext. Any environment with logging.level=trace (dev/staging) routed these into the log pipeline, where an attacker with log read access could forge JWTs. Replaced cleartext values with sha256-truncated fingerprints (16 hex chars) following the existing JWTSecretInfo.SecretSHA256 pattern. Found via Mistral review of pkg/server/middleware.go (Mistral noticed the trace logs while exploring related auth code). Mistral wrote the fix, trainer-takeover for the PR open + merge step (Q-059 max-turns hit before that step).
Critical security fix. The 3 Trace-level log statements at auth_service.go:117/123/130 were printing JWT tokens and HMAC signing secrets in cleartext. Any environment with logging.level=trace (dev/staging) routed these into the log pipeline, where an attacker with log read access could forge JWTs. Replaced cleartext values with sha256-truncated fingerprints (16 hex chars) following the existing JWTSecretInfo.SecretSHA256 pattern. Found via Mistral review of pkg/server/middleware.go (Mistral noticed the trace logs while exploring related auth code). Mistral wrote the fix, trainer-takeover for the PR open + merge step (Q-059 max-turns hit before that step).
Critical security fix. The 6 Trace-level log statements in auth_service.go
were printing JWT tokens and HMAC signing secrets in cleartext. Any environment
with logging.level=trace (dev/staging) routed these into the log pipeline,
where an attacker with log read access could forge JWTs. Replaced cleartext
values with sha256-truncated fingerprints (16 hex chars) following the existing
JWTSecretInfo.SecretSHA256 pattern.
Lines fixed:
- Line 109: signing_secret leak in GenerateJWT
- Line 118: token leak in GenerateJWT
- Line 124: token leak in ValidateJWT
- Line 131: secret leak in ValidateJWT (trying secret)
- Line 150: secret leak in ValidateJWT (validation successful)
- Line 158: secret leak in ValidateJWT (validation failed)
Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Critical security fix. The 3 Trace-level log statements at auth_service.go:117/123/130 were printing JWT tokens and HMAC signing secrets in cleartext. Any environment with logging.level=trace (dev/staging) routed these into the log pipeline, where an attacker with log read access could forge JWTs. Replaced cleartext values with sha256-truncated fingerprints (16 hex chars) following the existing JWTSecretInfo.SecretSHA256 pattern. Found via Mistral review of pkg/server/middleware.go (Mistral noticed the trace logs while exploring related auth code). Mistral wrote the fix, trainer-takeover for the PR open + merge step (Q-059 max-turns hit before that step).