Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Rejected channel save keeps the submitted secret in the banner

Open
  • Is something wrong?
#1,739 1 comment 1 reaction 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-3 hours
Newbie friendliness
25/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
csharp
Domain
desktop, security

Research direction

Start in PatchConfigDetailedAsync, where SanitizeErrorForLog runs before ex.Message is stored in ConfigPatchResult.Error, then check how the Channels and Config pages copy Error into the banner. The named tests SanitizeErrorForLog_RedactsChannelSecretsTheBannerWouldShow and SanitizeErrorForLog_KeepsAStaleBaseHashSignal define done. A fix already appears to exist on the linked branch, so confirm with the author before starting.

Written by the indexing model from the issue text.

Description

clawsweeper:needs-security-review clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:security issue-rating: 🦞 diamond lobster P2

What Problem

A rejected channel or config save put the gateway's raw config.patch error on screen. That error can echo the bot token, signing secret, or webhook URL that was just submitted. The tray log already scrubbed those values. The save banner, and a later refresh of that banner, did not.

Why

PatchConfigDetailedAsync logged SanitizeErrorForLog and then stored ex.Message in ConfigPatchResult.Error. The Channels page and the Config page copy Error into the status banner.

User Impact

A failed Telegram, Discord, Slack, Google Chat, Nostr, or Config page save no longer keeps the submitted secret in the banner. The failure reason stays, with those field values replaced by <redacted>. A stale base hash is still recognized after the scrub.

Evidence

SanitizeErrorForLog_RedactsChannelSecretsTheBannerWouldShow rejects a message that contains a bot token, a signing secret, and a webhook URL. SanitizeErrorForLog_KeepsAStaleBaseHashSignal still marks that error as a stale base hash.

Real behavior proof

The banner text is ConfigPatchResult.Error. Both pages assign that string and do not read the raw exception. The unit test feeds the same scrubber a gateway-shaped validation error and checks the secret strings are gone. The Channels page and the Config page were not opened.

Validation

./build.ps1 passed. Shared tests: 4317 passed, 34 skipped. Tray tests: 4083 passed.

Compare: https://github.com/openclaw/openclaw-windows-node/compare/main...SebTardif:fix/f087-scrub-channel-save-banner?expand=1

Dominant language
C#
Stars
2.2k
Forks
321
Avg merge
3d 15h
Merged PRs (30d)
175

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openclaw/openclaw-windows-node

All issues in openclaw/openclaw-windows-node

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.