secuity check

[czhang-circle]

FinancialAccountManager.java

• username and API key are logged
• username is logged
• customer name and balance should not be logged
• transaction details should not be logged
• e.printStackTrace(); it may expose sensitive information and should use a customized error message

config/config.yaml

• key is stored in plain-text

graphql/dataSources.ts

• the hard coded url maybe issue for different environments, like staging or production

pages/api/auth/[...nextauth].ts

• username and role should not be hardcoded here

permissions/check.ts

• role permission should not be hardcoded here