Aias00 opened a new issue, #823: URL: https://github.com/apache/rocketmq-dashboard/issues/823
## Problem `LoginDTO` uses Lombok `@Data` and contains the raw login `password` field. Lombok generates `toString()` with all fields by default, so accidental request DTO logging or debug output can expose login credentials. ## Evidence - `server/src/main/java/org/apache/rocketmq/studio/auth/LoginDTO.java` declares `@Data`. - The DTO includes a `password` field. - Other credential-bearing DTOs in Studio already exclude secrets from Lombok `toString()`. ## Expected behavior The login password should not appear in generated diagnostic output. ## Scope Small hardening fix for the Studio authentication path. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
