mirror of
https://github.com/go-admin-team/go-admin.git
synced 2026-09-22 18:37:43 +00:00
The answer was written at info level on every captcha request, so a currently valid answer sat in the application log. Anyone able to read the log - an operator, a log aggregator, anything that ships logs off the host - could bypass the check the captcha exists to enforce. The default log level records it, so this was not limited to debug builds.