From d85bef6c38bcda788ad9bbc0d4a076c6b3350f6c Mon Sep 17 00:00:00 2001 From: jvoisin Date: Tue, 14 Apr 2026 22:55:08 +0200 Subject: [PATCH] Don't leak credentials in debug_info No need to dump Gmail OAuth client_secret, refresh_token, and access_token in the debug ZIP in plaintext. --- cps/config_sql.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/cps/config_sql.py b/cps/config_sql.py index 8f0ab0857..5760e56e2 100644 --- a/cps/config_sql.py +++ b/cps/config_sql.py @@ -326,7 +326,9 @@ class ConfigSQL(object): def to_dict(self): storage = {} for k, v in self.__dict__.items(): - if k[0] != '_' and not k.endswith("_e") and not k == "cli" and 'api' not in k.lower(): + if k[0] != '_' and not k.endswith("_e") and not k == "cli" \ + and 'api' not in k.lower() and 'token' not in k.lower() \ + and 'secret' not in k.lower() storage[k] = v return storage