# UNDF: UNDF-2026-000001151
--- a/apps/meteor/server/oauth2-server/model.ts
+++ b/apps/meteor/server/oauth2-server/model.ts
@@ -39,7 +39,7 @@ export class Model implements AuthorizationCodeModel, RefreshTokenModel {

 	async getAccessToken(accessToken: string): Promise<Token | Falsey> {
 		if (this.debug === true) {
-			console.log('[OAuth2Server]', 'in getAccessToken (bearerToken:', accessToken, ')');
+			console.log('[OAuth2Server]', 'in getAccessToken (bearerToken: [REDACTED])');
 		}

@@ -67,7 +67,7 @@ export class Model implements AuthorizationCodeModel, RefreshTokenModel {
 	async getClient(clientId: string, clientSecret?: string): Promise<Client | Falsey> {
 		if (this.debug === true) {
-			console.log('[OAuth2Server]', 'in getClient (clientId:', clientId, ', clientSecret:', clientSecret, ')');
+			console.log('[OAuth2Server]', 'in getClient (clientId:', clientId, ', clientSecret: [REDACTED])');
 		}

@@ -92,7 +92,7 @@ export class Model implements AuthorizationCodeModel, RefreshTokenModel {
 	async getAuthorizationCode(authorizationCode: string): Promise<AuthorizationCode | Falsey> {
 		if (this.debug === true) {
-			console.log('[OAuth2Server]', `in getAuthorizationCode (authCode: ${authorizationCode})`);
+			console.log('[OAuth2Server]', 'in getAuthorizationCode (authCode: [REDACTED])');
 		}

@@ -167,11 +167,11 @@ export class Model implements AuthorizationCodeModel, RefreshTokenModel {
 	async saveToken(token: Token, client: Client, user: User): Promise<Token | Falsey> {
 		if (this.debug === true) {
 			console.log(
 				'[OAuth2Server]',
 				'in saveToken (token:',
-				token.accessToken,
+				'[REDACTED]',
 				', refreshToken:',
-				token.refreshToken,
+				'[REDACTED]',
 				', clientId:',
 				client.id,
 				', user:',
@@ -211,7 +211,7 @@ export class Model implements AuthorizationCodeModel, RefreshTokenModel {
 	async getRefreshToken(refreshToken: string): Promise<RefreshToken | Falsey> {
 		if (this.debug === true) {
-			console.log('[OAuth2Server]', `in getRefreshToken (refreshToken: ${refreshToken})`);
+			console.log('[OAuth2Server]', 'in getRefreshToken (refreshToken: [REDACTED])');
 		}

@@ -249,7 +249,7 @@ export class Model implements AuthorizationCodeModel, RefreshTokenModel {
 	async revokeToken(token: RefreshToken | Token): Promise<boolean> {
 		if (this.debug === true) {
-			console.log('[OAuth2Server]', `in revokeToken (token: ${token.accessToken})`);
+			console.log('[OAuth2Server]', 'in revokeToken (token: [REDACTED])');
 		}

@@ -268,7 +268,7 @@ export class Model implements AuthorizationCodeModel, RefreshTokenModel {
 	async revokeAuthorizationCode(code: AuthorizationCode): Promise<boolean> {
 		if (this.debug === true) {
-			console.log('[OAuth2Server]', `in revokeAuthorizationCode (code: ${code.authorizationCode})`);
+			console.log('[OAuth2Server]', 'in revokeAuthorizationCode (code: [REDACTED])');
 		}
 		await OAuthAuthCodes.deleteOne({ authCode: code.authorizationCode });
 		return true;
 	}