Skip to content

Remove plaintext password leak from admin auth log - #82

Merged
shammy911 merged 2 commits into
KavinduSDfrom
copilot/sub-pr-79-another-one
Mar 20, 2026
Merged

shammy911 merged 2 commits into
KavinduSDfrom
copilot/sub-pr-79-another-one

Conversation

Copilot AI commented Mar 20, 2026

Copy link
Copy Markdown
Contributor

The admin authorize callback was logging the full credentials object on successful login, exposing plaintext passwords in server logs.

Changes

  • app/api/auth/[...nextauth]/route.ts — Removed console.log("LOGIN ATTEMPT:", credentials) from the admin credentials authorize callback.
// Before
if (!ok) return null;
console.log("LOGIN ATTEMPT:", credentials); // ← leaked plaintext password

return { id: admin.id, email: admin.email, ... };

// After
if (!ok) return null;

return { id: admin.id, email: admin.email, ... };

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

…min authorize callback

Co-authored-by: shammy911 <180457932+shammy911@users.noreply.github.com>
Copilot AI changed the title [WIP] [WIP] Addressing feedback from PR #79 on "Kavindu sd" Remove plaintext password leak from admin auth log Mar 20, 2026
Copilot AI requested a review from shammy911 March 20, 2026 06:32
@shammy911
shammy911 marked this pull request as ready for review March 20, 2026 07:00
@shammy911
shammy911 merged commit f8cb8bc into KavinduSD Mar 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants