mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-11 14:00:29 +00:00
rcourtman
a7f87471f4
GET /api/notifications/apprise and the PUT echo returned the saved API key verbatim, so any settings:read token could exfiltrate a write-capable secret while the sibling email handler blanks the SMTP password under the same scope. Responses now drop the key and report hasApiKey instead, the update and test-send paths fall back to the saved key when the request leaves it blank (matching the email password contract), and the settings form tells the user a saved key is kept when the field stays empty.