security: obfuscate secrets in --debug=imap wire trace #22

New issue

Closed

opened 2026-05-11 23:40:00 +02:00 by heiko · 2 comments

heiko commented

2026-05-11 23:40:00 +02:00

Owner

The --debug=imap flag dumps raw IMAP wire traffic to stderr, including the LOGIN command with plaintext credentials:

T1 LOGIN "user@example.com" "password123"

This is a security concern when debug output is shared (logs, bug reports, screenshots).

Suggested Fix

Mask the password in the debug writer before emitting it, e.g.:

T1 LOGIN "user@example.com" "***"

internal/imap/client.go — DebugWriter passed to imapclient.Options

The `--debug=imap` flag dumps raw IMAP wire traffic to stderr, including the `LOGIN` command with plaintext credentials: ``` T1 LOGIN "user@example.com" "password123" ``` This is a security concern when debug output is shared (logs, bug reports, screenshots). ## Suggested Fix Mask the password in the debug writer before emitting it, e.g.: ``` T1 LOGIN "user@example.com" "***" ``` ## Related Code - `internal/imap/client.go` — `DebugWriter` passed to `imapclient.Options`

heiko added the

security

label

2026-05-13 14:09:45 +02:00

heiko commented

2026-05-13 14:11:44 +02:00

Author

Owner

Still open. The current debug writer still logs outbound IMAP commands before sending them, and Login still builds a raw LOGIN command containing the plaintext password.

heiko commented

2026-05-13 14:15:33 +02:00

Author

Owner

Fixed in 7dbe3b5. IMAP LOGIN debug output now redacts the password by default, with explicit opt-in via --expose-credentials. Regression tests added in pkg/imapclient/client_test.go for masked default and exposed opt-in behavior.

Fixed in 7dbe3b5. IMAP LOGIN debug output now redacts the password by default, with explicit opt-in via --expose-credentials. Regression tests added in pkg/imapclient/client_test.go for masked default and exposed opt-in behavior.

heiko closed this issue

2026-05-13 14:15:33 +02:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

IUS/xr-invoiced#22

No description provided.

Rows
Columns