[medium] GROUP_PDS_INVITE_CODE stored and forwarded as plaintext — leaked if config is exposed

[aspiers]

Summary

GROUP_PDS_INVITE_CODE is stored as a plaintext string in config and forwarded verbatim to the PDS createAccount call. If invite codes are single-use or rate-limited, any accidental config exposure (log line, debug endpoint, serialised context) would expose a usable invite code.

Details

• The value lives in AppContext alongside the encryption key.
• It is forwarded directly: inviteCode: config.groupPdsInviteCode in src/api/group/register.ts.
• There is no masking or redaction in place.

Suggested Fix

• Redact inviteCode from any logging or serialisation of config/AppContext.
• Evaluate whether the invite code needs to be validated/rotated after use.

[aspiers]

This issue was raised by Adam's AI analysis and should be taken with a pinch of salt.