mirror of
https://github.com/go-admin-team/go-admin.git
synced 2026-09-23 10:51:09 +00:00
zhangwenjian
484de2e698
The startup line printed the DSN whole: * => goadmin:<password>@tcp(host:3306)/go-admin?... So every deployment wrote its own database credential into its own logs, where a log shipper, a support bundle or a screenshot of a terminal carries it onward. Found while reading deploy output, which is exactly how it leaks. The host and username stay - they are what makes the line worth printing - and only the password is replaced. Both DSN shapes this project accepts are covered, a sqlite path is left alone, and anything unparseable is withheld rather than echoed, since it may hold a credential too.