What — Password-reset, email-verify and invitation links currently write their single-use tokens into the server access log.
Why — Anyone with log access (or a downstream log shipper) can replay a still-valid link; #3935 redacted the analytics sink but not the access log.
Scope — redactUrl() (lib/helpers/redactUrl.js) feeds morgan's :url token (lib/services/express.js:204) but never calls the redactPathSecrets() helper introduced by #3935 — a URL without a query string is returned verbatim, so GET /api/auth/reset/:token logs the raw token on every legitimate click. Fix: apply redactPathSecrets() to the path part on both branches (with and without query string) + a test asserting the morgan :url token emits REDACTED for a reset URL.
Refs: completes #3932 / #3935 (internal audit 2026-07-16, C1).
Created via /dev:issue
What — Password-reset, email-verify and invitation links currently write their single-use tokens into the server access log.
Why — Anyone with log access (or a downstream log shipper) can replay a still-valid link; #3935 redacted the analytics sink but not the access log.
Scope —
redactUrl()(lib/helpers/redactUrl.js) feeds morgan's:urltoken (lib/services/express.js:204) but never calls theredactPathSecrets()helper introduced by #3935 — a URL without a query string is returned verbatim, soGET /api/auth/reset/:tokenlogs the raw token on every legitimate click. Fix: applyredactPathSecrets()to the path part on both branches (with and without query string) + a test asserting the morgan:urltoken emitsREDACTEDfor a reset URL.Refs: completes #3932 / #3935 (internal audit 2026-07-16, C1).
Created via /dev:issue