WindowsAzure/azure-sdk-tools — Issue #60: security issue: contents of local server.js.logs made public after deploying to production
Author: vasili-zolotov
Created: 2011-12-22 04:39:32+00:00
State: open

The server.js.logs folder and its contents is clearly visible inside the package (which is just some nested zip files).

On top of that iisnode.exe running in Azure exposes the folder without any regard to the setting in the Web.cloud.config.

Put these two together and you will leak a snapshot of your emulator log when publishing which includes console.log output. Development logs can reveal all sorts of secrets.