GHSA-ww5p-j6cj-6mqq

### Summary The `GET /api/v1/ddns` and `GET /api/v1/notification` endpoints return full resource objects including plaintext third-party API credentials — Cloudflare API tokens, TencentCloud SecretKeys, Slack/Discord/Telegram webhook URLs with embedded bot tokens, and Authorization header values — without any field-level redaction. Any authenticated admin who calls these endpoints receives every stored credential in the system in a single API response. A compromised admin session or leaked PAT with `nezha:ddns:read` or `nezha:notification:read` scope exposes all third-party integration secrets. ### Details The `listDDNS` and `listNotification` handlers follow an identical pattern: they call the corresponding singleton `GetSortedList()`, `copier.Copy` the full in-memory structs into a response slice, and return them via `listHandler` with zero field stripping. **DDNS — `cmd/dashboard/controller/ddns.go:25–33`:** ```go func listDDNS(c *gin.Context) ([]*model.DDNSProfile, error) { var ddnsProfiles []*model.DDNSProfile list := singleton.DDNSShared.GetSortedList() if err := copier.Copy(&ddnsProfiles, &list); err != nil { return nil, err } return ddnsProfiles, nil } ``` The `DDNSProfile` struct (`model/ddns.go:20–36`) serializes `AccessSecret` with `json:"access_secret,omitempty"` — non-empty Cloudflare tokens and TencentCloud SecretKeys are returned in cleartext. The `WebhookURL` and `WebhookHeaders` fields may also contain embedded secrets. **Notification — `cmd/dashboard/controller/notification.go:25–33`:** ```go func listNotification(c *gin.Context) ([]*model.Notification, error) { slist := singleton.NotificationShared.GetSortedList() var notifications []*model.Notification if err := copier.Copy(&notifications, &slist); err != nil { return nil, err } return notifications, nil } ``` The `Notification` struct (`model/notification.go:34–44`) serializes `URL`, `RequestHeader`, and `RequestBody` — all of whic