Aias00 opened a new issue, #821: URL: https://github.com/apache/rocketmq-dashboard/issues/821
## Problem `DataSourceTestDTO` uses Lombok `@Data` and contains sensitive fields such as `password` and `bearerToken`. Lombok generates a `toString()` implementation that includes every field by default, so accidental DTO logging or validation/debug output can expose data source credentials. ## Evidence - `server/src/main/java/org/apache/rocketmq/studio/settings/DataSourceTestDTO.java` declares `@Data`. - The same DTO contains `password` and `bearerToken` fields. - Other LLM settings DTOs already exclude API keys from Lombok `toString()`, so this should follow the same redaction pattern. ## Expected behavior Sensitive fields should not appear in generated `toString()` output. They should be excluded or redacted while keeping the rest of the DTO useful for diagnostics. ## Scope This is a small hardening fix for the Studio settings / metrics data source path. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
