From f609891d0d7b547351d85aadddc5e00ae5244bcc Mon Sep 17 00:00:00 2001
From: ifedan-ed <ifedan-ed@users.noreply.github.com>
Date: Sun, 29 Mar 2026 10:41:35 +0000
Subject: [PATCH] Security: remove auth debug logging that exposed emails and
 responses

Removed console.log statements in auth.js that logged email addresses
and auth API responses to browser console. Final cleanup for v9.
---
 public/js/auth.js | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/public/js/auth.js b/public/js/auth.js
index 09fa36f..40b6dc7 100644
--- a/public/js/auth.js
+++ b/public/js/auth.js
@@ -15,11 +15,7 @@ document.addEventListener('DOMContentLoaded', function() {
   var TOKEN_KEY = 'ped_scribe_token';
   var USER_KEY = 'ped_scribe_user';
 
-  console.log('[Auth] Initializing...');
-  console.log('[Auth] authScreen:', !!authScreen);
-  console.log('[Auth] mainApp:', !!mainApp);
-  console.log('[Auth] loginForm:', !!loginForm);
-  console.log('[Auth] registerForm:', !!registerForm);
+  // Auth module initialized
 
   // Make sure forms are visible/hidden correctly on load
   showLoginForm();
@@ -315,7 +311,6 @@ document.addEventListener('DOMContentLoaded', function() {
         return false;
       }
 
-      console.log('[Auth] Attempting login for:', email);
       showLoading('Signing in...');
 
       var body = { email: email, password: password };
@@ -329,7 +324,6 @@ document.addEventListener('DOMContentLoaded', function() {
       .then(function(r) { return r.json(); })
       .then(function(data) {
         hideLoading();
-        console.log('[Auth] Login response:', JSON.stringify(data).substring(0, 200));
 
         if (data.requires2FA) {
           var grp = document.getElementById('totp-group');
@@ -413,7 +407,6 @@ document.addEventListener('DOMContentLoaded', function() {
         return false;
       }
 
-      console.log('[Auth] Registering:', email);
       showLoading('Creating account...');
 
       fetch('/api/auth/register', {
@@ -424,7 +417,6 @@ document.addEventListener('DOMContentLoaded', function() {
       .then(function(r) { return r.json(); })
       .then(function(data) {
         hideLoading();
-        console.log('[Auth] Register response:', JSON.stringify(data).substring(0, 200));
 
         if (data.success && data.token && data.user) {
           enterApp(data.user, data.token);