Description

In src/Servy.Core/Security/ProtectedKeyProvider.cs (line 160):

Logger.Error($"Failed to unprotect key at {path}. The file may have been moved from another machine.", ex);

The exact filesystem path to the DPAPI-protected key files (e.g., C:\ProgramData\Servy\security\aes_key.dat) is written to both the log file and Windows Event Log. This reveals the precise location to an attacker with read access to the logs.

Severity

Info — the key files are DPAPI-protected, so knowing the path alone is insufficient. However, combined with the ProgramData ACL issue (#357), this aids targeted attacks.

Suggested fix

Log a generic message without the full path:

Logger.Error("Failed to unprotect encryption key. The key file may have been moved from another machine.", ex);