Aias00 opened a new issue, #827: URL: https://github.com/apache/rocketmq-dashboard/issues/827
## Problem `AclUserVO` uses Lombok `@Data` and carries generated ACL credentials (`accessKey` and `secretKey`). Lombok includes all fields in the generated `toString()` output by default, so accidental VO logging or debug output can expose ACL credentials. ## Evidence - `server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclUserVO.java` declares `@Data`. - The VO contains `accessKey` and `secretKey` fields. - `AclService#createUser` generates and stores real values for both fields before returning the saved VO. ## Expected behavior Credential fields should be excluded from generated diagnostic output while non-sensitive ACL user metadata remains visible. ## Scope Small hardening fix for the Studio ACL user management path. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
