* security: redact secret names from logs, bind port to localhost
- handlers: replace secret names in Warn/Error logs with client IP
(prevents information disclosure via log access/injection)
- client: downgrade secret name logs from Info to Debug level
(Debug is discarded in production via io.Discard)
- docker-compose: bind port to 127.0.0.1:8080 instead of 0.0.0.0:8080
(prevents direct access bypassing reverse proxy)
Found during security pen test of vault.turboot.com
* Enhance logging for secret retrieval and cache access
Thijs Herman
e320f95d9f