-
Notifications
You must be signed in to change notification settings - Fork 7
Open
Description
In my opinion security relevant SDKs like the cidaas-android-sdk should not log any information.
However, there seems to be a few logging mechanisms (Log, Timber, LogFile) spread all over the sdk source.
I'm using "com.github.Cidaas:cidaas-android-sdk:3.2.9".
This class is even logging the AccessToken as (encrypted and base64 encoded) string:
de.cidaas.sdk.android.helper.converter.EntityToModelConverter
-> It contains the line Log.d("Encypted Strng", encryptedString);
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels