Potential Information Leakage

Open

#634 opened on Feb 29, 2024 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 2/5
Estimated time: 1-3 hours
Newbie friendliness: 45/100

Issue type: Bug
Clarity: Clearly specified
Activity status: Stale
Tech stack: python
Domain: security

Research direction

Start in tabpy/utils/tabpy_user.py at the linked line where the user name and password are sent to the logger. Reproduce the add-user flow, then verify that the resulting log output no longer exposes the password while retaining useful context.

Written by the indexing model from the issue text.

Description

question

Environment information:

OS: Ubuntu-22
Python version: 3.9
TabPy release: 2.9.0

Describe the issue
In code User name and password is directly put into logger. It is a potential security issue as described in CWE-532

To Reproduce
add user

Expected behavior
redacted the password

Dominant language: Python
Stars: 1.7k
Forks: 614
Avg merge: 2d 27m
Merged PRs (30d): 1

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Schema regression: derivation conversion_failure reverted Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

elong0527/yamaa#708 · Opened Sep 21, 2026
RadioSelectButtonGroup does not render as a button group through bootstrap_field Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

zostera/django-bootstrap4#894 · Opened Sep 21, 2026
[Bug]: control_ui.show_thinking = false does not stop the live reasoning stream, so thinking events and done.reasoning_content still reach the web UI Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

use-agent-os/agent-os#3276 · Opened Sep 21, 2026
Build fails with LTO enabled: conflicting types for z_shared_sw_isr_table between isr_tables.c and sw_isr_table.h Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

zephyrproject-rtos/zephyr#119726 · Opened Sep 21, 2026
[Bug]: redact_sensitive_text does not recognise Discord bot tokens Open

area/auth bug comp/agent P3 platform/discord type/security

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

NousResearch/hermes-agent#117848 · Opened Sep 21, 2026

More Python issues