fix(security): harden PoW XSS, email header injection and UptimeKuma log redaction

internal/apps/openflare/uptimekuma/client.go

@@ -17,6 +17,35 @@ import (
 	"time"
 )
 
+// redactSensitiveJSON masks values of sensitive keys (password, token, secret,
+// api key) so credentials never appear in logs.
+func redactSensitiveJSON(v any) any {
+	switch t := v.(type) {
+	case map[string]any:
+		for k, val := range t {
+			if isSensitiveLogKey(k) {
+				t[k] = "***"
+			} else {
+				t[k] = redactSensitiveJSON(val)
+			}
+		}
+	case []any:
+		for i, val := range t {
+			t[i] = redactSensitiveJSON(val)
+		}
+	}
+	return v
+}
+
+func isSensitiveLogKey(k string) bool {
+	switch strings.ToLower(k) {
+	case "password", "passwd", "secret", "token", "access_token", "api_key", "apikey":
+		return true
+	default:
+		return false
+	}
+}
+
 const emitAckTimeout = 10 * time.Second
 
 // Monitor represents a monitor entry from Uptime Kuma.
@@ -292,7 +321,14 @@ func (c *SocketIOClient) Emit(event string, args ...any) (string, error) {
 	}
 
 	body := fmt.Sprintf("42%d%s", id, string(bs))
-	slog.Debug("Emitting Socket.IO event", "event", event, "ackID", id, "payload", string(bs))
+	logPayload := string(bs)
+	var decoded any
+	if err := json.Unmarshal(bs, &decoded); err == nil {
+		if redacted, err := json.Marshal(redactSensitiveJSON(decoded)); err == nil {
+			logPayload = string(redacted)
+		}
+	}
+	slog.Debug("Emitting Socket.IO event", "event", event, "ackID", id, "payload", logPayload)
 
 	u := fmt.Sprintf("%s/socket.io/?EIO=4&transport=polling&sid=%s", c.baseURL, c.sid)
 	req, err := http.NewRequestWithContext(c.ctx, http.MethodPost, u, strings.NewReader(body))

internal/apps/openflare/uptimekuma/client_test.go

@@ -0,0 +1,28 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package uptimekuma
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRedactSensitiveJSON(t *testing.T) {
+	payload := []byte(`["login",{"username":"admin","password":"s3cret","nested":{"token":"abc","label":"keep"}},"plain"]`)
+	var decoded any
+	require.NoError(t, json.Unmarshal(payload, &decoded))
+	out, err := json.Marshal(redactSensitiveJSON(decoded))
+	require.NoError(t, err)
+
+	s := string(out)
+	assert.NotContains(t, s, "s3cret")
+	assert.NotContains(t, s, "abc")
+	assert.Contains(t, s, `"password":"***"`)
+	assert.Contains(t, s, `"token":"***"`)
+	assert.Contains(t, s, `"label":"keep"`)
+	assert.Contains(t, s, `"username":"admin"`)
+}