yyqdbngt opened a new pull request, #3399:
URL: https://github.com/apache/rocketmq-dashboard/pull/3399

   ## Summary
   
   Removes the plaintext `accessKey` from the `log.info` emitted on every 
plain-access config upsert. The line now logs only non-secret attributes 
(`admin` flag and whether a whitelist is configured), consistent with the 
`@ToString.Exclude` convention applied to the credential-bearing ACL rows/VOs.
   
   ## Why
   
   Access keys authenticate RocketMQ plain-ACL clients; logging them at info 
level on every create/update puts credentials into application logs (a common 
exfiltration/forensic path). Nothing downstream depends on the logged value.
   
   ## Testing
   
   `mvn -B test -Dtest=AclServiceTest` — 64/64 pass (compile + full service 
suite); checkstyle (validate) clean.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to