When an API request using the ?key= query-string form throws, the Diagnostic Center records the full request URL including the key (e.g. Unhandled exception processing http://host:8622/api/json/?key=...). The key is then readable by anyone with Diagnostic Center access or via LogMessages_GetMessages. Suggest redacting key when logging request URLs. (Workaround on our side: send the key as the X-ApiKey header instead.)

]]>https://forums.inedo.com/topic/5807/bug-api-keys-written-to-the-error-log-in-cleartext-when-using-key-authRSS for NodeThu, 06 Aug 2026 20:59:20 GMTThu, 06 Aug 2026 17:47:42 GMT60