GPT-5 finding
Logging OAuth/JWT token prefixes leaks sensitive information to logs
mediumsecurityhigh
- src/bridge/jwtUtils.ts
- src/bridge/jwtUtils.ts
Even partial token values are sensitive and can be abused in some environments (e.g., if logs are accessible to other processes or uploaded to external services). Multiple log statements intentionally include the first 15 characters of tokens. This violates least-privilege for observable data and increases risk of credential exposure.
Recommendation
Never log any portion of tokens. Replace with constant strings like 'present' or use a constant-length masking (e.g., '<redacted>') without including characters from the token. Remove all uses of token.slice() in log output.