# UNDF: UNDF-2026-000001122
# UNDF: UNDF-2026-XXXXXXXXX
--- a/src/Applewin.cpp
+++ b/src/Applewin.cpp
@@ -868,7 +868,12 @@ static void LoadConfiguration(bool registry)
   }
   // Print some debug strings
-  printf("Ready login = %s\n", g_sFTPUserPass);
+  {
+    /* CWE-312: g_sFTPUserPass is "user:password" — never log verbatim. */
+    const char *colon = strchr(g_sFTPUserPass, ':');
+    int user_len = colon ? (int)(colon - g_sFTPUserPass) : (int)strlen(g_sFTPUserPass);
+    printf("Ready login = %.*s:***\n", user_len, g_sFTPUserPass);
+  }
 }