RockteMQ-AI commented on issue #568:
URL: 
https://github.com/apache/rocketmq-dashboard/issues/568#issuecomment-5771463991

   **Issue Evaluation**
   
   Category: `enhancement` | Status: **Evaluated**
   
   This is a well-structured security improvement proposal for ACL credential 
handling.
   
   **Assessment:**
   - Returning complete credentials only at creation time is the correct 
security pattern
   - Masking in list/update responses prevents credential leakage through the 
API
   - Merging editable metadata with stored user (instead of full replacement) 
avoids accidental credential overwrite
   - Frontend changes to remove credential fields from update payloads are 
necessary to complete the fix
   
   **Feasibility:** Feasible — changes are localized to ACL user management 
endpoints and the frontend ACL page.
   **Scope:** Backend ACL service + controller, frontend ACL user management 
component.
   **Compatibility:** No breaking changes expected — masked responses are a 
security improvement that existing consumers should handle gracefully.
   
   This issue is ready for implementation. A maintainer can pick it up or 
community members can contribute a PR.
   
   ---
   *Automated evaluation by github-manager*


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to