FYI if you use the #NVDA translation addon polyglot: it stores API keys and passwords in nvda.ini in cleartext. If your NVDA log level is anything above info, those values will be written to nvda.log, even if the addon was disabled or removed at the time. I have filed an issue and PR, and am sure this will be fixed shortly. But in the meantime, if you use this addon and have filed any bugs with #nvdasr or with any other addon, and included a copy of nvda.log, you must rotate all API keys and passwords for all of your translation services. github.com/cary-rowen/polyglot/issues/20
@fastfinge NVDA 2026.2 will redact such secrets where it detects them, but it's a good reminder that most users should have logging level set to info most of the time. If recreating a bug for an issue and if you "restart NVDA with debug logging", it will go back to your previous level (info) next restart
@fastfinge Yes and it looks like there's some discussion in that original issue on ways for the add-on to address that, even if finding a workable solution is more complex than it may at first seem :)
@NVAccess Yes, the original issue in this thread and pr are mine. Unfortunately doing security right means adding complexity, the authors dislike of the fact not withstanding. I’m hoping this can be resolved without me needing to fork and maintain a version that meets security requirements.
