fix: drop the masked key rendering, clearing CodeQL alert #3

[zerotrustdavid]

Closes CodeQL alert #3, js/clear-text-logging, src/components/web3forms.tsx:182.

Alert #1 closed on the merge of #18. #3 opened against the replacement, same rule.

This is not the same mistake twice, but the alert is right

The version before #18 printed the key in full. #18 printed four leading and four trailing characters. Fewer characters is not no characters, and CodeQL is pointing at something real.

Which field could actually be tainted

describeKey returned four fields. Only one carried the value's content:

Field	Derivation	Tainted?
length	.length → number	no
trimmedWhitespace	comparison result	no
note	one of a fixed set of string literals, selected by branching	no — implicit flow only, which CodeQL does not track
masked	key.slice(0, 4) + key.slice(-4)	yes, via String.prototype.slice

The one field the analyser objects to is the one field genuinely carrying key material. That alignment is the useful signal here: the tool was right, and #18's comment — "The value is described, never reproduced" — was not quite true, because eight characters of it were being reproduced.

Removing it costs nothing

Every distinction the branch exists to draw survives without it:

Case	length	trimmed	note
empty	0	false	empty
whitespace only	0	true	whitespace only
placeholder text	13	false	not hex and dashes
truncated	30	false	hex and dashes but too short
valid + stray char	37	false	not hex and dashes

Empty and whitespace-only are separated by trimmedWhitespace, which is the only signal that can do it once length is 0. Placeholder and truncated by note. Verified across all five, with an assertion that no four-character run of a real key appears anywhere in the output.

The masked value was only ever an aid to identifying which key arrived — and it could not do that job here anyway. A valid-but-wrong key passes UUID.test and never reaches this branch.

Not dismissed

The alert is resolved by removing the flow, not by marking it a false positive.

Calling it one would have required arguing that eight characters of a credential are not credential material. That is precisely the shape of claim this repository has already had to walk back twice — the rotate claim, and the "not a UUID therefore not a credential" comment that #18 itself corrected. Dismissing would have been a third.

Also

Two stale comments describing the removed masking are corrected in the same change, found by grepping rather than by memory. Leaving them would have reproduced the exact failure mode that let the rotate claim survive its first correction cycle.

Verified

npm run lint, npx tsc --noEmit and npm run build all clean. No slice or repeat on the key value remains anywhere in the file.

One honest caveat

I cannot run CodeQL here, so I cannot prove in advance that the alert closes. The reasoning is that slice was the only taint-propagating step, and removing it should cut the dataflow. The confirmation is the alert closing after merge — if it does not, the remaining flow is through .length or the branch-selected note, and that would be worth knowing.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
invisionsolutions	Ready	Preview	Aug 27, 2026 12:38am