fix: prevent credential exposure via process listings and logs

[taranveer-tengurchittoo]

Summary

• Replace positional password arguments to bw CLI with --passwordenv to prevent exposure via /proc/PID/cmdline
• Mask SMTP password in application logs

Problem

1. Master password visible in process listings

check_logged_in(), unlock_vault(), and login_bitwarden() pass the Bitwarden master password as a positional argument:

command = shlex.split(f"bw unlock --raw {password}")
subprocess.run(command, ...)

On Linux, any process on the system can read this from /proc/PID/cmdline. On shared hosts, Docker containers with --pid=host, or systems with monitoring agents, the vault master password is readable by any user or process that can enumerate the process table (ps aux).

2. SMTP password logged in plaintext

send_email_notification() logs the SMTP password at INFO level:

logging.info(f"SMTP_PASSWORD: {smtp_password}")

Log files are often persisted, aggregated to centralized logging, or visible in CI/CD output.

Fix

Password in CLI args: Replaced with --passwordenv BW_PASSWORD, which tells the bw CLI to read the password from an environment variable. The variable is set only on the subprocess environment dict (via the env parameter to subprocess.run), not on the parent process os.environ, so it does not leak to other child processes.

SMTP password logging: Replaced with a static ******** mask.

References

• Bitwarden CLI docs on --passwordenv
• CWE-214: Invocation of Process Using Visible Sensitive Information