Nick Craig-Wood
8b812fff28
Previously running rclone config (or driving it via the rc API or web GUI) with -vv would write secrets to the debug log. This was dangerous as users debugging a failing config flow often paste their -vv logs into the forum or GitHub issues. These values are now redacted from the log as "XXX". Values whose option is known are only redacted if the option is marked IsPassword or Sensitive, so normal answers remain visible. Use --dump auth to see the unredacted values when debugging a config flow - rclone prints a warning that secrets will appear in the log when this is in effect. This was discovered by CodeQL: https://github.com/rclone/rclone/security/code-scanning/182