From 6da1165e29d74b99cb93630e592062f0e64b6339 Mon Sep 17 00:00:00 2001
From: Hazelnoot <acomputerdog@gmail.com>
Date: Sat, 14 Jun 2025 00:24:32 -0400
Subject: [PATCH] hide admin secrets from the mod log

---
 .../server/api/endpoints/admin/update-meta.ts | 24 +++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/packages/backend/src/server/api/endpoints/admin/update-meta.ts b/packages/backend/src/server/api/endpoints/admin/update-meta.ts
index 7c3d485a0f..4970d28cfa 100644
--- a/packages/backend/src/server/api/endpoints/admin/update-meta.ts
+++ b/packages/backend/src/server/api/endpoints/admin/update-meta.ts
@@ -778,9 +778,29 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 			const after = await this.metaService.fetch(true);
 
 			this.moderationLogService.log(me, 'updateServerSettings', {
-				before,
-				after,
+				before: sanitize(before),
+				after: sanitize(after),
 			});
 		});
 	}
 }
+
+function sanitize(meta: Partial<MiMeta>): Partial<MiMeta> {
+	return {
+		...meta,
+		hcaptchaSecretKey: '<redacted>',
+		mcaptchaSecretKey: '<redacted>',
+		recaptchaSecretKey: '<redacted>',
+		turnstileSecretKey: '<redacted>',
+		fcSecretKey: '<redacted>',
+		smtpPass: '<redacted>',
+		swPrivateKey: '<redacted>',
+		objectStorageAccessKey: '<redacted>',
+		objectStorageSecretKey: '<redacted>',
+		deeplAuthKey: '<redacted>',
+		libreTranslateKey: '<redacted>',
+		verifymailAuthKey: '<redacted>',
+		truemailAuthKey: '<redacted>',
+	};
+}
+