# Secret disclosure in rendered output

Unmasked secrets, metadata, or credential headers leaking through templates, converters, or filters

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; one confirmed bounty: $480; latest 2026-10-20. Updated 2026-10-24._

## How it works
A security control that should remove or mask sensitive data is applied on one code path but not on every path that produces output. The assumption that breaks is "the scrubber runs wherever the data is rendered." In practice the scrubber is attached to execution, to one converter branch, or to a dynamically built filter, and any path that renders the same data without passing through it emits the secret in the clear.

## Where it shows up
- Masking done at task-execution or log-write time, while a separate UI view renders the same template [E2](https://bugbountylibrary.com/r/h1%3A1773895.md)
- Per-format or per-conversion-path metadata scrubbing (e.g. HEIC branch vs other image branches) [E3](https://bugbountylibrary.com/r/h1%3A1069039.md)
- Security filters built as regexes from user- or config-supplied values, with a hand-written escaper [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-8r9p-f939-6h3c.md)
- States where a task never runs (skipped, queued, upstream-failed) but its template is still shown [E2](https://bugbountylibrary.com/r/h1%3A1773895.md)
- Header-stripping filters constructed once at client construction, not per request [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-8r9p-f939-6h3c.md)

## How to review
Identify every output surface (UI views, converted files, outbound requests) and confirm the scrubber runs on all of them, not just the primary one. For regex-based filters, diff the escaper's character class against the full metacharacter set and test each declared value against the generated pattern; the invariant is that every declared sensitive value matches the filter exactly and no metacharacter changes its meaning [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-8r9p-f939-6h3c.md). For masking, the invariant is that no rendered view can display a secret regardless of task state [E2](https://bugbountylibrary.com/r/h1%3A1773895.md). For converters, the invariant is that output files carry no EXIF/GPS regardless of input format or upload path [E3](https://bugbountylibrary.com/r/h1%3A1069039.md).

## Variants seen
- Incomplete regex escaping in a header filter lets credential headers survive cross-origin redirects [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-8r9p-f939-6h3c.md)
- Masking bypassed on skipped-task template rendering in a web UI [E2](https://bugbountylibrary.com/r/h1%3A1773895.md)
- Metadata scrubbing missing on one image conversion branch [E3](https://bugbountylibrary.com/r/h1%3A1069039.md)

## Impact and severity
Credential headers leaked to third parties across redirects [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-8r9p-f939-6h3c.md), connection passwords exposed in a UI [E2](https://bugbountylibrary.com/r/h1%3A1773895.md), and uploaders' home GPS coordinates publicly reachable via image URLs [E3](https://bugbountylibrary.com/r/h1%3A1069039.md). Severity rises when the leak is persistent and publicly addressable (E3) or crosses a trust boundary to an attacker-controlled host (E1). Per-path gaps are easy to miss because the main path looks safe.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-8r9p-f939-6h3c.md
- E2: https://bugbountylibrary.com/r/h1%3A1773895.md
- E3: https://bugbountylibrary.com/r/h1%3A1069039.md