[Security] Phone verification codes (OTP) written to logs at Information level #692

New Issue

2026-07-17T23:05:04Z

spikerj commented

2026-07-17 23:05:04 +00:00

Finding (sensitive data in logs)

Two handlers log the actual phone verification code (a short-lived 6-digit OTP) into the structured log stream (Seq) at Information level:

VerifyPhoneNumberCommandHandler.cs:17 — LogInformation("Verifying phone number for user {UserId} with code {Code}", request.UserId, request.VerificationCode)
Twilio/Commands/ProcessTwilioWebhook/ProcessTwilioWebhookCommandHandler.cs:305 — LogInformation("Processing phone verification for {PhoneNumber} with code {Code}", phoneNumber, verificationCode)

Anyone with log/Seq access (or anyone downstream of log shipping/retention/backup) can read active OTP codes and, within the code's validity window, complete a phone verification they should not control. OTP/credentials do not belong in application logs (OWASP logging guidance).

Fix (this PR)

Drop the {Code} argument from both log messages — keep the user/phone context for correlation, remove the credential. No logic/behaviour change. (The pre-registration email handler already logs only validity/attempts, not the code — good; these two were the exceptions.)

## Finding (sensitive data in logs) Two handlers log the actual phone verification code (a short-lived 6-digit OTP) into the structured log stream (Seq) at Information level: - `VerifyPhoneNumberCommandHandler.cs:17` — `LogInformation("Verifying phone number for user {UserId} with code {Code}", request.UserId, request.VerificationCode)` - `Twilio/Commands/ProcessTwilioWebhook/ProcessTwilioWebhookCommandHandler.cs:305` — `LogInformation("Processing phone verification for {PhoneNumber} with code {Code}", phoneNumber, verificationCode)` Anyone with log/Seq access (or anyone downstream of log shipping/retention/backup) can read active OTP codes and, within the code's validity window, complete a phone verification they should not control. OTP/credentials do not belong in application logs (OWASP logging guidance). ## Fix (this PR) Drop the `{Code}` argument from both log messages — keep the user/phone context for correlation, remove the credential. No logic/behaviour change. (The pre-registration email handler already logs only validity/attempts, not the code — good; these two were the exceptions.)

spikerj commented

2026-07-17 23:15:17 +00:00

Resolved in spikersoft-backend PR #388 (merged to master). Removed the 6-digit OTP from both handlers' logs, including the webhook entry-point log (redacted via Is6DigitCode when an inbound SMS body is a code). Active verification codes no longer reach Seq. Closing.

Resolved in spikersoft-backend PR #388 (merged to `master`). Removed the 6-digit OTP from both handlers' logs, including the webhook entry-point log (redacted via Is6DigitCode when an inbound SMS body is a code). Active verification codes no longer reach Seq. Closing.

spikerj closed this issue

2026-07-17 23:15:17 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#692