fix: Prevent exposure of GotifyToken in JSON response for enhanced security

2026-02-20 14:07:21 +00:00
parent 1d909afe41
commit 1e14dcd59c
1 changed files with 1 additions and 1 deletions
--- a/backend/internal/services/enhanced_security_notification_service.go
+++ b/backend/internal/services/enhanced_security_notification_service.go
@@ -41,7 +41,7 @@ type CompatibilitySettings struct {
 	DiscordWebhookURL        string `json:"discord_webhook_url,omitempty"`
 	SlackWebhookURL          string `json:"slack_webhook_url,omitempty"`
 	GotifyURL                string `json:"gotify_url,omitempty"`
-	GotifyToken              string `json:"gotify_token,omitempty"`
+	GotifyToken              string `json:"-"` // Security: Never expose token in JSON (OWASP A02)
 }

 // MigrationMarker represents the migration state stored in settings table.