From 59a4a417940ebbaa550bf426aae5aa13f50cea3f Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Tue, 27 Oct 2026 14:28:45 +0100
Subject: [PATCH 1/6] fix: Only handle http(s) links

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 src/Components/ActionButton.vue               |  3 ++-
 src/Components/NotificationItem.vue           |  3 ++-
 .../Parameters/DefaultParameter.vue           | 10 ++++++--
 src/Components/Parameters/FileParameter.vue   |  7 +++++-
 src/services/webNotificationsService.js       |  3 ++-
 src/utils/link.js                             | 24 +++++++++++++++++++
 6 files changed, 44 insertions(+), 6 deletions(-)
 create mode 100644 src/utils/link.js

diff --git a/src/Components/ActionButton.vue b/src/Components/ActionButton.vue
index e7da1a0c3..1ba4f09ba 100644
--- a/src/Components/ActionButton.vue
+++ b/src/Components/ActionButton.vue
@@ -6,6 +6,7 @@
 <script setup>
 import { computed } from 'vue'
 import NcButton from '@nextcloud/vue/components/NcButton'
+import { isSafeLink } from '../utils/link.js'
 
 /**
  * @typedef {object} NotificationAction
@@ -25,7 +26,7 @@ const props = defineProps({
 
 const emit = defineEmits(['click'])
 
-const isWebLink = computed(() => props.action.type === 'WEB')
+const isWebLink = computed(() => props.action.type === 'WEB' && isSafeLink(props.action.link))
 
 /**
  * Emits a click event with the action details
diff --git a/src/Components/NotificationItem.vue b/src/Components/NotificationItem.vue
index 5cec7dea3..e116c305c 100644
--- a/src/Components/NotificationItem.vue
+++ b/src/Components/NotificationItem.vue
@@ -105,6 +105,7 @@ import ActionButton from './ActionButton.vue'
 import DefaultParameter from './Parameters/DefaultParameter.vue'
 import FileParameter from './Parameters/FileParameter.vue'
 import UserParameter from './Parameters/UserParameter.vue'
+import { isSafeLink } from '../utils/link.js'
 
 /**
  * @typedef {object} NotificationItem
@@ -171,7 +172,7 @@ export default {
 		},
 
 		useLink() {
-			if (!this.notification.link) {
+			if (!isSafeLink(this.notification.link)) {
 				return false
 			}
 
diff --git a/src/Components/Parameters/DefaultParameter.vue b/src/Components/Parameters/DefaultParameter.vue
index 233b50ee3..019979097 100644
--- a/src/Components/Parameters/DefaultParameter.vue
+++ b/src/Components/Parameters/DefaultParameter.vue
@@ -10,7 +10,7 @@
 		<strong>{{ name }}</strong>
 	</a>
 	<a
-		v-else-if="link"
+		v-else-if="hasSafeLink"
 		:href="link"
 		class="external"
 		target="_blank"
@@ -21,6 +21,8 @@
 </template>
 
 <script>
+import { isSafeLink } from '../../utils/link.js'
+
 export default {
 	name: 'DefaultParameter',
 	props: {
@@ -47,8 +49,12 @@ export default {
 	},
 
 	computed: {
+		hasSafeLink() {
+			return isSafeLink(this.link)
+		},
+
 		hasInternalLink() {
-			return this.link && (
+			return this.hasSafeLink && (
 				this.type === 'deck-board'
 				|| this.type === 'deck-card'
 			)
diff --git a/src/Components/Parameters/FileParameter.vue b/src/Components/Parameters/FileParameter.vue
index bc53dd250..98d0c646f 100644
--- a/src/Components/Parameters/FileParameter.vue
+++ b/src/Components/Parameters/FileParameter.vue
@@ -7,11 +7,12 @@
 	<a
 		:title="title"
 		class="filename"
-		:href="link">{{ name }}</a>
+		:href="safeLink">{{ name }}</a>
 </template>
 
 <script>
 import { t } from '@nextcloud/l10n'
+import { isSafeLink } from '../../utils/link.js'
 
 export default {
 	name: 'FileParameter',
@@ -46,6 +47,10 @@ export default {
 	},
 
 	computed: {
+		safeLink() {
+			return isSafeLink(this.link) ? this.link : undefined
+		},
+
 		title() {
 			const lastSlashPosition = this.path.lastIndexOf('/')
 			const firstSlashPosition = this.path.indexOf('/')
diff --git a/src/services/webNotificationsService.js b/src/services/webNotificationsService.js
index 84445e859..a270799e4 100644
--- a/src/services/webNotificationsService.js
+++ b/src/services/webNotificationsService.js
@@ -8,6 +8,7 @@ import { loadState } from '@nextcloud/initial-state'
 import { getLanguage } from '@nextcloud/l10n'
 import { generateFilePath } from '@nextcloud/router'
 import { Howl } from 'howler'
+import { isSafeLink } from '../utils/link.js'
 import BrowserStorage from './BrowserStorage.js'
 
 /**
@@ -75,7 +76,7 @@ async function createWebNotification(notification) {
 		tag: notification.notificationId,
 	})
 
-	if (notification.link) {
+	if (isSafeLink(notification.link)) {
 		n.onclick = async function() {
 			const event = {
 				cancelAction: false,
diff --git a/src/utils/link.js b/src/utils/link.js
new file mode 100644
index 000000000..3ba61d96a
--- /dev/null
+++ b/src/utils/link.js
@@ -0,0 +1,24 @@
+/*!
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+const ALLOWED_PROTOCOLS = ['http:', 'https:']
+
+/**
+ * Check that a link is relative or uses the http(s) scheme
+ *
+ * @param {string} link The link to check
+ * @return {boolean}
+ */
+export function isSafeLink(link) {
+	if (!link) {
+		return false
+	}
+
+	try {
+		return ALLOWED_PROTOCOLS.includes(new URL(link, window.location.href).protocol)
+	} catch {
+		return false
+	}
+}

From d36a19c41b0e10cd8bee61fec1380d5051cf7718 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Tue, 27 Oct 2026 14:35:33 +0100
Subject: [PATCH 2/6] fix(push): Rate limit device registration

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 lib/Controller/PushController.php               | 2 ++
 lib/Controller/WebPushController.php            | 2 ++
 tests/Unit/Controller/PushControllerTest.php    | 9 +++++++++
 tests/Unit/Controller/WebPushControllerTest.php | 9 +++++++++
 4 files changed, 22 insertions(+)

diff --git a/lib/Controller/PushController.php b/lib/Controller/PushController.php
index 3fd9d829a..26b0cee25 100644
--- a/lib/Controller/PushController.php
+++ b/lib/Controller/PushController.php
@@ -16,6 +16,7 @@
 use OCP\AppFramework\Http\Attribute\ApiRoute;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
 use OCP\AppFramework\Http\Attribute\OpenAPI;
+use OCP\AppFramework\Http\Attribute\UserRateLimit;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\OCSController;
 use OCP\Authentication\Exceptions\InvalidTokenException;
@@ -60,6 +61,7 @@ public function __construct(
 	 * 401: Missing permissions to register device
 	 */
 	#[NoAdminRequired]
+	#[UserRateLimit(limit: 10, period: 3600)]
 	#[ApiRoute(verb: 'POST', url: '/api/{apiVersion}/push', requirements: ['apiVersion' => '(v2)'])]
 	public function registerDevice(string $pushTokenHash, string $devicePublicKey, string $proxyServer): DataResponse {
 		$user = $this->userSession->getUser();
diff --git a/lib/Controller/WebPushController.php b/lib/Controller/WebPushController.php
index 20e209d8f..5cdef3983 100644
--- a/lib/Controller/WebPushController.php
+++ b/lib/Controller/WebPushController.php
@@ -18,6 +18,7 @@
 use OCP\AppFramework\Http\Attribute\ApiRoute;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
 use OCP\AppFramework\Http\Attribute\OpenAPI;
+use OCP\AppFramework\Http\Attribute\UserRateLimit;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\OCSController;
 use OCP\AppFramework\Services\IAppConfig;
@@ -80,6 +81,7 @@ public function getVapid(): DataResponse {
 	 * 403: Web push is disabled by the administrator
 	 */
 	#[NoAdminRequired]
+	#[UserRateLimit(limit: 20, period: 600)]
 	#[ApiRoute(verb: 'POST', url: '/api/{apiVersion}/webpush', requirements: ['apiVersion' => '(v2)'])]
 	public function registerWP(string $endpoint, string $uaPublicKey, string $auth, string $appTypes): DataResponse {
 		if (!$this->appConfig->getAppValueBool('webpush_enabled')) {
diff --git a/tests/Unit/Controller/PushControllerTest.php b/tests/Unit/Controller/PushControllerTest.php
index 98e486d28..c3af9deaf 100644
--- a/tests/Unit/Controller/PushControllerTest.php
+++ b/tests/Unit/Controller/PushControllerTest.php
@@ -15,6 +15,7 @@
 use OC\Security\IdentityProof\Manager;
 use OCA\Notifications\Controller\PushController;
 use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\UserRateLimit;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\IDBConnection;
 use OCP\IRequest;
@@ -470,4 +471,12 @@ public function testRemoveDevice(bool $userIsValid, int $tokenId, bool $tokenIsV
 		$this->assertSame($status, $response->getStatus());
 		$this->assertSame($payload, $response->getData());
 	}
+
+	public function testRegisterIsRateLimited(): void {
+		$attributes = (new \ReflectionMethod(PushController::class, 'registerDevice'))->getAttributes(UserRateLimit::class);
+		$this->assertCount(1, $attributes);
+		$rateLimit = $attributes[0]->newInstance();
+		$this->assertSame(10, $rateLimit->getLimit());
+		$this->assertSame(3600, $rateLimit->getPeriod());
+	}
 }
diff --git a/tests/Unit/Controller/WebPushControllerTest.php b/tests/Unit/Controller/WebPushControllerTest.php
index 7b839f0b0..82f0eea03 100644
--- a/tests/Unit/Controller/WebPushControllerTest.php
+++ b/tests/Unit/Controller/WebPushControllerTest.php
@@ -17,6 +17,7 @@
 use OCA\Notifications\WebPush\NewSubStatus;
 use OCA\Notifications\WebPushClient;
 use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\UserRateLimit;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\Services\IAppConfig;
 use OCP\IDBConnection;
@@ -499,4 +500,12 @@ public function testRemoveSubscription(bool $userIsValid, int $tokenId, bool $to
 		$this->assertSame($status, $response->getStatus());
 		$this->assertSame($payload, $response->getData());
 	}
+
+	public function testRegisterIsRateLimited(): void {
+		$attributes = (new \ReflectionMethod(WebPushController::class, 'registerWP'))->getAttributes(UserRateLimit::class);
+		$this->assertCount(1, $attributes);
+		$rateLimit = $attributes[0]->newInstance();
+		$this->assertSame(20, $rateLimit->getLimit());
+		$this->assertSame(600, $rateLimit->getPeriod());
+	}
 }

From a462399fab7b53808e011932dbd9ebcdcc250107 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Tue, 27 Oct 2026 14:37:20 +0100
Subject: [PATCH 3/6] test(integration): Don't fail local testing due to rate
 limit

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 tests/Integration/run.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tests/Integration/run.sh b/tests/Integration/run.sh
index 6ff320e30..eaeefc685 100755
--- a/tests/Integration/run.sh
+++ b/tests/Integration/run.sh
@@ -21,12 +21,21 @@ ${ROOT_DIR}/occ app:enable provisioning_api
 ${ROOT_DIR}/occ app:list | grep notifications
 ${ROOT_DIR}/occ app:list | grep provisioning_api
 
+RATELIMIT_ENABLED=$(${ROOT_DIR}/occ config:system:get ratelimit.protection.enabled)
+${ROOT_DIR}/occ config:system:set ratelimit.protection.enabled --value false --type boolean
+
 export TEST_SERVER_URL="http://localhost:8080/"
 ${APP_INTEGRATION_DIR}/vendor/bin/behat --colors -f junit -f pretty $1 $2
 RESULT=$?
 
 #kill $PHPPID
 
+if [ -n "$RATELIMIT_ENABLED" ]; then
+	${ROOT_DIR}/occ config:system:set ratelimit.protection.enabled --value "$RATELIMIT_ENABLED" --type boolean
+else
+	${ROOT_DIR}/occ config:system:delete ratelimit.protection.enabled
+fi
+
 ${ROOT_DIR}/occ app:disable notificationsintegrationtesting
 rm -rf ../../../notificationsintegrationtesting
 

From 1fca99e5201d7c2700fc015d325726551cd91855 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Tue, 27 Oct 2026 14:40:42 +0100
Subject: [PATCH 4/6] fix(service-worker): Only focus same-origin windows

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Joas Schilling <coding@schilljs.com>

From 9a849f3a067b5cc98cae299691beb115031485bd Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Tue, 27 Oct 2026 14:48:28 +0100
Subject: [PATCH 5/6] fix(push): Throw exception when signing of push fails

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 lib/Push.php            | 28 +++++++++++---
 tests/Unit/PushTest.php | 83 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 105 insertions(+), 6 deletions(-)

diff --git a/lib/Push.php b/lib/Push.php
index b0d33ef4f..5c8dd5d9f 100644
--- a/lib/Push.php
+++ b/lib/Push.php
@@ -476,6 +476,8 @@ public function proxyPushToDevice(int $id, IUser $user, array $devices, INotific
 			} catch (\InvalidArgumentException) {
 				// Failed to encrypt message for device: public key is invalid
 				$this->deleteProxyPushToken($device['token']);
+			} catch (\RuntimeException) {
+				// Failed to sign message, already logged
 			}
 		}
 		$this->printInfo('');
@@ -666,6 +668,8 @@ public function proxyPushDeleteToDevice(string $userId, IUser $user, array $devi
 			} catch (\InvalidArgumentException) {
 				// Failed to encrypt message for device: public key is invalid
 				$this->deleteProxyPushToken($device['token']);
+			} catch (\RuntimeException) {
+				// Failed to sign message, already logged
 			}
 		}
 
@@ -975,6 +979,19 @@ protected function getNotifTopicAndUrgency(string $app, string $type): array {
 		return $res;
 	}
 
+	/**
+	 * @throws \RuntimeException when the data could not be signed
+	 */
+	protected function sign(string $data, string $userPrivateKey): string {
+		if (!openssl_sign($data, $signature, $userPrivateKey, OPENSSL_ALGO_SHA512)) {
+			$error = openssl_error_string() ?: 'Unknown OpenSSL error';
+			$this->log->error($error, ['app' => 'notifications']);
+			$this->printInfo('<error>Failed to sign encrypted push subject: "' . $error . '"</error>');
+			throw new \RuntimeException('Failed to sign message for device');
+		}
+		return $signature;
+	}
+
 	/**
 	 * @param string $userPrivateKey
 	 * @param array $device
@@ -984,6 +1001,7 @@ protected function getNotifTopicAndUrgency(string $app, string $type): array {
 	 * @psalm-return array{deviceIdentifier: string, pushTokenHash: string, subject: string, signature: string, priority: string, type: string}
 	 * @throws InvalidTokenException
 	 * @throws \InvalidArgumentException
+	 * @throws \RuntimeException
 	 */
 	protected function encryptAndSign(string $userPrivateKey, array $device, int $id, INotification $notification): array {
 		$data = $this->encodeNotif($id, $notification, 200);
@@ -1004,11 +1022,8 @@ protected function encryptAndSign(string $userPrivateKey, array $device, int $id
 			throw new \InvalidArgumentException('Failed to encrypt message for device');
 		}
 
-		if (openssl_sign($encryptedSubject, $signature, $userPrivateKey, OPENSSL_ALGO_SHA512)) {
-			$this->printInfo('Signed encrypted push subject');
-		} else {
-			$this->printInfo('<error>Failed to signed encrypted push subject</error>');
-		}
+		$signature = $this->sign($encryptedSubject, $userPrivateKey);
+		$this->printInfo('Signed encrypted push subject');
 		$base64EncryptedSubject = base64_encode($encryptedSubject);
 		$base64Signature = base64_encode($signature);
 
@@ -1030,6 +1045,7 @@ protected function encryptAndSign(string $userPrivateKey, array $device, int $id
 	 * @psalm-return array{remaining: array<array-key, int>, payload: array{deviceIdentifier: string, pushTokenHash: string, subject: string, signature: string, priority: string, type: string}}
 	 * @throws InvalidTokenException
 	 * @throws \InvalidArgumentException
+	 * @throws \RuntimeException
 	 */
 	protected function encryptAndSignDelete(string $userPrivateKey, array $device, ?array $ids): array {
 		$ret = $this->encodeDeleteNotifs($ids);
@@ -1043,7 +1059,7 @@ protected function encryptAndSignDelete(string $userPrivateKey, array $device, ?
 			throw new \InvalidArgumentException('Failed to encrypt message for device');
 		}
 
-		openssl_sign($encryptedSubject, $signature, $userPrivateKey, OPENSSL_ALGO_SHA512);
+		$signature = $this->sign($encryptedSubject, $userPrivateKey);
 		$base64EncryptedSubject = base64_encode($encryptedSubject);
 		$base64Signature = base64_encode($signature);
 
diff --git a/tests/Unit/PushTest.php b/tests/Unit/PushTest.php
index 2c2da7372..2b198748f 100644
--- a/tests/Unit/PushTest.php
+++ b/tests/Unit/PushTest.php
@@ -396,6 +396,89 @@ public function testProxyPushToDeviceEncryptionError(): void {
 		$push->pushToDevice(1970, $notification);
 	}
 
+	public function testProxyPushToDeviceSigningError(): void {
+		$push = $this->getPush(['getProxyDevicesForUser', 'encryptAndSign', 'deleteProxyPushToken', 'filterByTokenAge']);
+		$this->clientService->expects($this->never())
+			->method('newClient');
+
+		$this->config->expects($this->once())
+			->method('getSystemValueBool')
+			->with('has_internet_connection', true)
+			->willReturn(true);
+
+		/** @var INotification&MockObject $notification */
+		$notification = $this->createMock(INotification::class);
+		$notification
+			->method('getUser')
+			->willReturn('valid');
+
+		/** @var IUser&MockObject $user */
+		$user = $this->createStub(IUser::class);
+
+		$this->userManager->expects($this->once())
+			->method('getExistingUser')
+			->with('valid')
+			->willReturn($user);
+
+		$push->expects($this->once())
+			->method('getProxyDevicesForUser')
+			->willReturn([[
+				'proxyserver' => 'proxyserver1',
+				'token' => 23,
+				'apptype' => 'other',
+			]]);
+
+		$this->l10nFactory
+			->method('getUserLanguage')
+			->with($user)
+			->willReturn('ru');
+
+		$this->notificationManager->expects($this->once())
+			->method('prepare')
+			->with($notification, 'ru')
+			->willReturnArgument(0);
+
+		/** @var Key&MockObject $key */
+		$key = $this->createStub(Key::class);
+
+		$this->keyManager->expects($this->once())
+			->method('getKey')
+			->with($user)
+			->willReturn($key);
+
+		$push->expects($this->once())
+			->method('filterByTokenAge')
+			->willReturnArgument(0);
+
+		$push->expects($this->once())
+			->method('encryptAndSign')
+			->willThrowException(new \RuntimeException());
+
+		$push->expects($this->never())
+			->method('deleteProxyPushToken');
+
+		$push->pushToDevice(1970, $notification);
+	}
+
+	public function testSign(): void {
+		$key = openssl_pkey_new(['private_key_bits' => 2048]);
+		openssl_pkey_export($key, $privateKey);
+		$publicKey = openssl_pkey_get_details($key)['key'];
+
+		$push = $this->getPush();
+		$signature = self::invokePrivate($push, 'sign', ['data', $privateKey]);
+		$this->assertSame(1, openssl_verify('data', $signature, $publicKey, OPENSSL_ALGO_SHA512));
+	}
+
+	public function testSignFailure(): void {
+		$this->logger->expects($this->once())
+			->method('error');
+
+		$push = $this->getPush();
+		$this->expectException(\RuntimeException::class);
+		@self::invokePrivate($push, 'sign', ['data', 'invalid key']);
+	}
+
 	public function testProxyPushToDeviceNoFairUse(): void {
 		$push = $this->getPush(['getProxyDevicesForUser', 'encryptAndSign', 'deleteProxyPushToken', 'filterByTokenAge', 'deleteProxyPushTokenByDeviceIdentifier']);
 

From 29d4572b2c799e63aca766b7718e65a75c7c986f Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Tue, 27 Oct 2026 16:04:46 +0100
Subject: [PATCH 6/6] fix(sensitive-parameters): Mark parameters as sensitive
 to avoid logging them

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Joas Schilling <coding@schilljs.com>

[skip ci]
---
 lib/Controller/PushController.php    | 10 +++++-----
 lib/Controller/WebPushController.php | 12 ++++++------
 lib/Push.php                         |  8 ++++----
 lib/WebPushClient.php                |  4 ++--
 4 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/lib/Controller/PushController.php b/lib/Controller/PushController.php
index 26b0cee25..e4b439786 100644
--- a/lib/Controller/PushController.php
+++ b/lib/Controller/PushController.php
@@ -63,7 +63,7 @@ public function __construct(
 	#[NoAdminRequired]
 	#[UserRateLimit(limit: 10, period: 3600)]
 	#[ApiRoute(verb: 'POST', url: '/api/{apiVersion}/push', requirements: ['apiVersion' => '(v2)'])]
-	public function registerDevice(string $pushTokenHash, string $devicePublicKey, string $proxyServer): DataResponse {
+	public function registerDevice(#[\SensitiveParameter] string $pushTokenHash, string $devicePublicKey, string $proxyServer): DataResponse {
 		$user = $this->userSession->getUser();
 		if (!$user instanceof IUser) {
 			return new DataResponse([], Http::STATUS_UNAUTHORIZED);
@@ -181,7 +181,7 @@ public function removeDevice(): DataResponse {
 	/**
 	 * @return bool If the hash was new to the database
 	 */
-	protected function savePushToken(IUser $user, IToken $token, string $deviceIdentifier, string $devicePublicKey, string $pushTokenHash, string $proxyServer, string $appType): bool {
+	protected function savePushToken(IUser $user, IToken $token, string $deviceIdentifier, string $devicePublicKey, #[\SensitiveParameter] string $pushTokenHash, string $proxyServer, string $appType): bool {
 		$query = $this->db->getQueryBuilder();
 		$query->select('*')
 			->from('notifications_pushhash')
@@ -204,7 +204,7 @@ protected function savePushToken(IUser $user, IToken $token, string $deviceIdent
 	/**
 	 * @return bool If the entry was created
 	 */
-	protected function insertPushToken(IUser $user, IToken $token, string $deviceIdentifier, string $devicePublicKey, string $pushTokenHash, string $proxyServer, string $appType): bool {
+	protected function insertPushToken(IUser $user, IToken $token, string $deviceIdentifier, string $devicePublicKey, #[\SensitiveParameter] string $pushTokenHash, string $proxyServer, string $appType): bool {
 		$devicePublicKeyHash = hash('sha512', $devicePublicKey);
 
 		$query = $this->db->getQueryBuilder();
@@ -225,7 +225,7 @@ protected function insertPushToken(IUser $user, IToken $token, string $deviceIde
 	/**
 	 * @return bool If the entry was updated
 	 */
-	protected function updatePushToken(IUser $user, IToken $token, string $devicePublicKey, string $pushTokenHash, string $proxyServer, string $appType): bool {
+	protected function updatePushToken(IUser $user, IToken $token, string $devicePublicKey, #[\SensitiveParameter] string $pushTokenHash, string $proxyServer, string $appType): bool {
 		$devicePublicKeyHash = hash('sha512', $devicePublicKey);
 
 		$query = $this->db->getQueryBuilder();
@@ -256,7 +256,7 @@ protected function deletePushToken(IUser $user, IToken $token): bool {
 	/**
 	 * @return bool If the entry was deleted
 	 */
-	protected function deletePushTokenByHash(IUser $user, string $pushTokenHash): bool {
+	protected function deletePushTokenByHash(IUser $user, #[\SensitiveParameter] string $pushTokenHash): bool {
 		$query = $this->db->getQueryBuilder();
 		$query->delete('notifications_pushhash')
 			->where($query->expr()->eq('uid', $query->createNamedParameter($user->getUID())))
diff --git a/lib/Controller/WebPushController.php b/lib/Controller/WebPushController.php
index 5cdef3983..1c6219ec8 100644
--- a/lib/Controller/WebPushController.php
+++ b/lib/Controller/WebPushController.php
@@ -83,7 +83,7 @@ public function getVapid(): DataResponse {
 	#[NoAdminRequired]
 	#[UserRateLimit(limit: 20, period: 600)]
 	#[ApiRoute(verb: 'POST', url: '/api/{apiVersion}/webpush', requirements: ['apiVersion' => '(v2)'])]
-	public function registerWP(string $endpoint, string $uaPublicKey, string $auth, string $appTypes): DataResponse {
+	public function registerWP(#[\SensitiveParameter] string $endpoint, string $uaPublicKey, #[\SensitiveParameter] string $auth, string $appTypes): DataResponse {
 		if (!$this->appConfig->getAppValueBool('webpush_enabled')) {
 			return new DataResponse(['message' => 'WEBPUSH_DISABLED'], Http::STATUS_FORBIDDEN);
 		}
@@ -163,7 +163,7 @@ public function registerWP(string $endpoint, string $uaPublicKey, string $auth,
 	 */
 	#[NoAdminRequired]
 	#[ApiRoute(verb: 'POST', url: '/api/{apiVersion}/webpush/activate', requirements: ['apiVersion' => '(v2)'])]
-	public function activateWP(string $activationToken): DataResponse {
+	public function activateWP(#[\SensitiveParameter] string $activationToken): DataResponse {
 		if (!$this->appConfig->getAppValueBool('webpush_enabled')) {
 			return new DataResponse(['message' => 'WEBPUSH_DISABLED'], Http::STATUS_FORBIDDEN);
 		}
@@ -246,7 +246,7 @@ protected function getWPClient(): WebPushClient {
 	 * - CREATED if the user didn't have an activated subscription with this endpoint, pubkey and auth
 	 * - UPDATED if the subscription has been updated (use to change appTypes)
 	 */
-	protected function saveSubscription(IUser $user, IToken|ISession $token, string $endpoint, string $uaPublicKey, string $auth, string $appTypes): array {
+	protected function saveSubscription(IUser $user, IToken|ISession $token, #[\SensitiveParameter] string $endpoint, string $uaPublicKey, #[\SensitiveParameter] string $auth, string $appTypes): array {
 		$query = $this->db->getQueryBuilder();
 		$query->select('*')
 			->from('notifications_webpush')
@@ -284,7 +284,7 @@ protected function saveSubscription(IUser $user, IToken|ISession $token, string
 	 * - NO_TOKEN if we don't have this token
 	 * - NO_SUB if we don't have this subscription
 	 */
-	protected function activateSubscription(IUser $user, IToken|ISession $token, string $activationToken): ActivationSubStatus {
+	protected function activateSubscription(IUser $user, IToken|ISession $token, #[\SensitiveParameter] string $activationToken): ActivationSubStatus {
 		$query = $this->db->getQueryBuilder();
 		$query->select('*')
 			->from('notifications_webpush')
@@ -318,7 +318,7 @@ protected function activateSubscription(IUser $user, IToken|ISession $token, str
 	 * @param string $appTypes comma separated list of types
 	 * @return bool If the entry was created
 	 */
-	protected function insertSubscription(IUser $user, IToken|ISession $token, string $endpoint, string $uaPublicKey, string $auth, string $activationToken, string $appTypes): bool {
+	protected function insertSubscription(IUser $user, IToken|ISession $token, #[\SensitiveParameter] string $endpoint, string $uaPublicKey, #[\SensitiveParameter] string $auth, #[\SensitiveParameter] string $activationToken, string $appTypes): bool {
 		$query = $this->db->getQueryBuilder();
 		$query->insert('notifications_webpush')
 			->values([
@@ -337,7 +337,7 @@ protected function insertSubscription(IUser $user, IToken|ISession $token, strin
 	 * @param string $appTypes comma separated list of types
 	 * @return bool If the entry was updated
 	 */
-	protected function updateSubscription(IUser $user, IToken|ISession $token, string $endpoint, string $uaPublicKey, string $auth, string $appTypes): bool {
+	protected function updateSubscription(IUser $user, IToken|ISession $token, #[\SensitiveParameter] string $endpoint, string $uaPublicKey, #[\SensitiveParameter] string $auth, string $appTypes): bool {
 		$query = $this->db->getQueryBuilder();
 		$query->update('notifications_webpush')
 			->set('endpoint', $query->createNamedParameter($endpoint))
diff --git a/lib/Push.php b/lib/Push.php
index 5c8dd5d9f..3b969a455 100644
--- a/lib/Push.php
+++ b/lib/Push.php
@@ -982,7 +982,7 @@ protected function getNotifTopicAndUrgency(string $app, string $type): array {
 	/**
 	 * @throws \RuntimeException when the data could not be signed
 	 */
-	protected function sign(string $data, string $userPrivateKey): string {
+	protected function sign(string $data, #[\SensitiveParameter] string $userPrivateKey): string {
 		if (!openssl_sign($data, $signature, $userPrivateKey, OPENSSL_ALGO_SHA512)) {
 			$error = openssl_error_string() ?: 'Unknown OpenSSL error';
 			$this->log->error($error, ['app' => 'notifications']);
@@ -1003,7 +1003,7 @@ protected function sign(string $data, string $userPrivateKey): string {
 	 * @throws \InvalidArgumentException
 	 * @throws \RuntimeException
 	 */
-	protected function encryptAndSign(string $userPrivateKey, array $device, int $id, INotification $notification): array {
+	protected function encryptAndSign(#[\SensitiveParameter] string $userPrivateKey, #[\SensitiveParameter] array $device, int $id, INotification $notification): array {
 		$data = $this->encodeNotif($id, $notification, 200);
 		$ret = $this->getNotifTopicAndUrgency($data['app'], $data['type']);
 		$priority = $ret['urgency'];
@@ -1047,7 +1047,7 @@ protected function encryptAndSign(string $userPrivateKey, array $device, int $id
 	 * @throws \InvalidArgumentException
 	 * @throws \RuntimeException
 	 */
-	protected function encryptAndSignDelete(string $userPrivateKey, array $device, ?array $ids): array {
+	protected function encryptAndSignDelete(#[\SensitiveParameter] string $userPrivateKey, #[\SensitiveParameter] array $device, ?array $ids): array {
 		$ret = $this->encodeDeleteNotifs($ids);
 		$remainingIds = $ret['remaining'];
 		$data = $ret['data'];
@@ -1190,7 +1190,7 @@ protected function deleteWebPushToken(int $tokenId): bool {
 	 * @param string $endpoint
 	 * @return bool
 	 */
-	protected function deleteWebPushTokenByEndpoint(string $endpoint): bool {
+	protected function deleteWebPushTokenByEndpoint(#[\SensitiveParameter] string $endpoint): bool {
 		$query = $this->db->getQueryBuilder();
 		$query->delete('notifications_webpush')
 			->where($query->expr()->eq('endpoint', $query->createNamedParameter($endpoint)));
diff --git a/lib/WebPushClient.php b/lib/WebPushClient.php
index a0774592d..9c67d45c0 100644
--- a/lib/WebPushClient.php
+++ b/lib/WebPushClient.php
@@ -39,7 +39,7 @@ public static function isValidP256dh(string $key): bool {
 		return true;
 	}
 
-	public static function isValidAuth(string $auth): bool {
+	public static function isValidAuth(#[\SensitiveParameter] string $auth): bool {
 		if (!preg_match('/^[A-Za-z0-9_-]{22}=*$/', $auth)) {
 			return false;
 		}
@@ -106,7 +106,7 @@ public function getVapidPublicKey(): string {
 	/**
 	 * Send one notification - blocking (should be avoided most of the time)
 	 */
-	public function notify(string $endpoint, string $uaPublicKey, string $auth, string $body): void {
+	public function notify(#[\SensitiveParameter] string $endpoint, string $uaPublicKey, #[\SensitiveParameter] string $auth, #[\SensitiveParameter] string $body): void {
 		$c = $this->getClient();
 		$c->queueNotification(
 			new Subscription($endpoint, $uaPublicKey, $auth, 'aes128gcm'),