Keep hook-token and share-token hashes out of JSON; the OAuth secret prefix is a label

Shipped

October 18, 2026 at 7:03 AM UTC

Author

Kamo

Commit

e8eb153

**************** was red on main: **************** and previousHookTokenHash, **************** and previousHookTokenHash, and IotShare.tokenHash had no @JsonIgnore. KamoOAuthClient.secretPrefix (first 12 characters, shown to tell secrets apart; the secret is kept only as secretHash) joins NOT_CREDENTIALS with that reason.