Stop printing GitHub secrets to the server log

[jarstelfox]

🤖

Every time Pulldasher starts, it writes three GitHub secrets into its log: the OAuth app secret, the API token and the webhook secret. Anyone who can read that log can read all three. This removes the line that prints them, and stops the webhook handler from logging the wrong secret a caller sent.

Summary

• Startup: console.log(config.github) runs whenever something loads lib/git-manager.js, so the server and all six bin/refresh-* scripts print it. It came in with 5db15a2 and has been on master since Bump @octokit/request, @octokit/plugin-throttling and @octokit/rest #419 merged on 2025-03-04.
• Webhooks: a call with the wrong ?secret= is logged with the value it sent, and that value can be a real secret, such as another instance's. It still logs Invalid Hook Secret, now without the value.

Nothing else on the server logs a secret. The MySQL password only goes into the database connection, and Octokit replaces the token with [REDACTED] in the errors we log.

Output with the test config, before and after

On master, loading lib/git-manager.js prints:

{
  clientId: 'test-client-id',
  secret: 'test-secret',
  callbackURL: 'http://localhost:3000/auth/github/callback',
  token: 'test-token',
  hook_secret: 'test-hook-secret'
}

A webhook call with ?secret=wrong-value then adds Invalid Hook Secret: wrong-value. On this branch the first prints nothing and the second prints only Invalid Hook Secret.

Note

Deploying this stops new copies. Logs written before the deploy still hold what was printed then.

QA

• Run npm test on Node 24. CI only runs lint and build.

• From the repo root, run this and confirm it prints nothing:

  CONFIG_PATH=../test/fixtures/config.js node --input-type=module -e "await import('./lib/git-manager.js'); process.exit(0)"

• Run this and confirm it prints Invalid Hook Secret without wrong-value:

  CONFIG_PATH=../test/fixtures/config.js node --input-type=module -e "const { default: hooks } = await import('./controllers/githubHooks.js'); hooks.main({ query: { secret: 'wrong-value' } }, { status() { return this; }, send() {} }); process.exit(0)"

🤖 Generated with Claude Code

[djmetzle]

CR 🔏