maziggy b71b721658 fix(security): stop leaking webhook tokens via httpx debug logging ...

Settings → Support → Debug Logging elevated httpx/httpcore to DEBUG,
  which makes httpx log every outbound request URL. For Discord and
  generic webhook notifications the bearer token is embedded in the URL
  path, so users who turned on debug logging to capture a support bundle
  were writing their webhook tokens straight into bambuddy.log.

  Pin httpx/httpcore to WARNING regardless of the debug toggle. paho.mqtt
  still honours debug. Users who enabled debug logging while notifications
  were sending must rotate any exposed Discord/webhook URLs — the token
  is the path, so the whole URL has to be regenerated in the provider UI.

2026-04-14 09:13:55 +02:00

..

routes

fix(security): stop leaking webhook tokens via httpx debug logging

2026-04-14 09:13:55 +02:00

__init__.py

…