Duansg opened a new pull request, #4220: URL: https://github.com/apache/hertzbeat/pull/4220
## What's changed The notice receiver GET endpoints returned credentials in clear text. This masks them in the api response while keeping the configuration editable. - Mask the 11 credential fields of `NoticeReceiver` in the three receiver GET endpoints. - Restore the stored value on `editReceiver` / `sendTestMsg`, so saving without retyping a credential keeps the existing one. - A credential of 12+ chars keeps its last 4 visible (`******voJM`), shorter ones are fully masked. The placeholder is fixed-length so it does not leak the real length. Masking is applied at the controller only — `getReceiverById` still returns real values because `AlertNoticeDispatch` needs them to send notifications. No frontend change required. ## Tests Tests have been conducted on existing and new data, and they were successfully passed. ## Checklist - [x] I have read the [Contributing Guide](https://hertzbeat.apache.org/docs/community/code_style_and_quality_guide) - [ ] I have written the necessary doc or comment. - [ ] I have added the necessary unit tests and all cases have passed. ## Add or update API - [ ] I have added the necessary [e2e tests](https://github.com/apache/hertzbeat/tree/master/e2e) and all cases have passed. <img width="1300" height="732" alt="Jul-20-2026 20-23-02" src="https://github.com/user-attachments/assets/6baa2b37-c345-4a4f-b85a-d3b89d2d4f09"; /> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
