ladeiko / node-apple-receipt-verify

A Node.js module for In-App-Purchase receipt validation for iOS.
MIT License
92 stars 25 forks source link

Hide password from logs #27

Closed pjlangley closed 3 years ago

pjlangley commented 3 years ago

Hi @ladeiko.

I noticed that the password is being exposed in the logs (for me, in AWS), and I considered it a security vector. I find the debugging ability in production very useful for diagnosing issues, but I wouldn't want my shared secret to be visible in this scenario.

I thought I'd create a PR straight away, in case you agreed with this approach, in order to speed things up.

Either way, I'm keen to get your thoughts on this.