From 916c147b4dbc483b72989c2fe720d1bf35f87da5 Mon Sep 17 00:00:00 2001
From: Julian Cuni <julian.cuni@microservices.al>
Date: Sat, 27 Jun 2026 14:13:45 +0200
Subject: [PATCH] fix(camera): drop debug console.log(c) leaking the camera
 password to logs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Hikvision driver's create() had a leftover `console.log(c)` that dumped the
ENTIRE camera config — including the plaintext `password` — to stdout every time
the adapter was built, on every request that resolves a camera. That puts a device
credential in the logs (which get shipped/cached/read — the booth operator is the
adversary). Removed. Swept the rest of the shipped source: no other console.* leaks.
---
 packages/devices/src/drivers/camera.ts | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/packages/devices/src/drivers/camera.ts b/packages/devices/src/drivers/camera.ts
index 9277960..54c521a 100644
--- a/packages/devices/src/drivers/camera.ts
+++ b/packages/devices/src/drivers/camera.ts
@@ -236,14 +236,12 @@ export const hikvisionDriver: CameraDriver = {
   configFields: [...hikvisionConfigFields, ...alarmPushFields],
   // ISAPI channel id: <channel><stream>, e.g. ch1 main = 101, ch1 sub = 102, ch2 main = 201.
   // stream 1 → "01" (main), 2 → "02" (sub).
-  create: (c) => {
-    console.log(c);
-    return new HttpCamera(
+  create: (c) =>
+    new HttpCamera(
       "hikvision",
       c,
       (ch, stream) => `/ISAPI/Streaming/channels/${ch}0${stream}/picture`,
-    );
-  },
+    ),
 };
 
 export const dahuaDriver: CameraDriver = {