From 9843d850e1a23ccaeabcd058447323bec4465847 Mon Sep 17 00:00:00 2001
From: pedrooot <pedromarting3@gmail.com>
Date: Thu, 16 Apr 2026 17:32:38 +0200
Subject: [PATCH] fix(ui): disable Next.js 16 Server Function arg logging to
 stop leaking sign-in credentials

---
 ui/CHANGELOG.md   | 1 +
 ui/next.config.js | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index 304d934af1..832cadcfa8 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -7,6 +7,7 @@ All notable changes to the **Prowler UI** are documented in this file.
 ### 🔒 Security
 
 - Upgrade React to 19.2.5 and Next.js to 16.2.3 to mitigate CVE-2026-23869 (React2DoS), a high-severity unauthenticated remote DoS vulnerability in the React Flight Protocol's Server Function deserialization [(#10754)](https://github.com/prowler-cloud/prowler/pull/10754)
+- Disable Next.js 16 Server Function argument logging to prevent sign-in credentials (email/password) from being printed to the terminal during development
 
 ---
 
diff --git a/ui/next.config.js b/ui/next.config.js
index d5987c3603..3744d8104f 100644
--- a/ui/next.config.js
+++ b/ui/next.config.js
@@ -46,6 +46,12 @@ const nextConfig = {
   turbopack: {
     root: __dirname,
   },
+  logging: {
+    // Next.js 16 prints every Server Function call with its arguments
+    // (e.g. `authenticate(null, {email, password}) ...`), which leaks
+    // credentials and other sensitive payloads to the terminal.
+    serverFunctions: false,
+  },
   async headers() {
     const sentryEndpoint = getSentryReportEndpoint();
     const headers = [