fix: keep RDP creds out of tunnel URL/logs via single-use encrypted stash

server/cmd/main.go

@@ -56,7 +56,9 @@ func main() {
 	}()
 
 	// Start REST server
-	r := gin.Default()
+	r := gin.New()
+	r.Use(gin.Recovery())
+	r.Use(gin.LoggerWithConfig(gin.LoggerConfig{SkipPaths: []string{"/api/console/tunnel"}}))
 	r.Use(corsMiddleware())
 	api.RegisterRoutes(r)