_🔒 Security & Privacy_ | _🟠 Major_ | _⚡ Quick win_

[Fabito97]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -n -C2 'HashEmail|emailHash|Cancellation link request|Cancellation link sent|Failed to send waitlist cancellation link' \
  api-dotnet/src/Application/Features/Waitlist/Commands/RequestWaitlistCancellation.cs \
  api-dotnet/src/Web/Controllers/WaitlistController.cs

Repository: hngprojects/vulnwatch-api

Length of output: 4804

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,220p' api-dotnet/src/Application/Features/Waitlist/Commands/RequestWaitlistCancellation.cs
printf '\n--- controller ---\n'
sed -n '90,140p' api-dotnet/src/Web/Controllers/WaitlistController.cs

Repository: hngprojects/vulnwatch-api

Length of output: 8120

---

Avoid logging deterministic email hashes here. The 8-character SHA-256 prefix is still a stable, email-derived identifier on an anonymous endpoint and can be dictionary-matched or used to correlate requests. Use generic log messages, or a keyed HMAC with a private logging key if correlation is needed.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@api-dotnet/src/Application/Features/Waitlist/Commands/RequestWaitlistCancellation.cs`
around lines 45 - 52, The RequestWaitlistCancellation flow is logging a
deterministic email-derived hash for a masked anonymous endpoint, which should
be removed or replaced. In RequestWaitlistCancellation, avoid calling HashEmail
for the non-existent-email log path and change the _logger.LogInformation
message to a generic one without any email-derived identifier; if correlation is
required, use a private keyed HMAC-based identifier instead of the SHA-256
prefix.

✅ Addressed in commits ae337a7 to b5dae8a

Originally posted by @coderabbitai[bot] in #145 (comment)