GHSA-4pfc-fvr6-wj82

redactRcloneCredentials() — added in #4648 and shipped in v0.29.9 — never fires on the backup path it was written for. The S3 access key and secret access key are still written in plaintext to docker service logs dokploy on every backup run, on the current release (v0.29.13).

The cause is a format mismatch between the code that builds the rclone command and the code that redacts it.

The builder — packages/server/src/utils/backups/utils.ts — quotes values with the shell-quote library:

The redactor — packages/server/src/utils/backups/redact.ts — matches only double-quoted values:

shell-quote's quote() never emits double quotes. It returns safe values bare, and uses single quotes or backslash escapes when escaping is required:

Because the producer never emits the double-quoted form the regex requires, the redaction cannot match — for any credential value. The credentials then reach the application logger here: