CRITICAL: DON'T USE Leaking user credentials to `https://api.r2explorer.dev/api/releases/latest/` about r2-explorer HOT 2 CLOSED

Hey there, i just disabled the update checker and pushed it to everyone using the default dashboard.

The bug here was that when you log onto a basic auth server, I'm defining the Authentication header as default in axios (source here), and this was the reason the auth token were being sent to that url.

If you are concerned with authentication, you should definitely enable Cloudflare Access on your instance docs here.

from r2-explorer.

Thanks for reporting this issue, I'm closing it as the fix has already been pushed, feel free to open another one if you find anything else

from r2-explorer.