Qwen Code fixes a DingTalk credential leak in debug logs

Qwen Code's DingTalk channel logged the bot's clientSecret in plain text every time it connected. A clientSecret is a long-lived credential that doesn't rotate on its own. QwenLM merged the fix in the DingTalk channel patch, part of the v0.23.1-preview.0 preview line.

If a debug log line with that value reaches a log aggregator, a support ticket, or a screen share, the secret is exposed. It stays exposed until someone rotates it by hand on the DingTalk side.

Any CLI that bridges an agent into a chat platform, Slack, DingTalk, Teams, whatever, holds a credential to authenticate as that bot. Connect code is where a developer adds a print statement or a debug log to confirm the handshake worked. The secret sits in memory at that exact moment, ready to get written somewhere it shouldn't.

The patch notes don't say how long the logging existed, or whether any users saw secrets in shipped log output. If you've run an affected build, rotate your DingTalk clientSecret. Updating the CLI alone won't invalidate a secret that already leaked.

Maintaining a similar bridge means grepping connect and auth-handshake code for credential fields passed straight into a logger call. That check takes minutes and catches the bug before a security report does.