fix(payments): avoid tainted log format string

[kilo-code-bot]

Summary

• Pass the Stripe checkout session ID as a separate console.info argument so externally controlled input cannot become the format string for the successful credit-transaction log.
• Scope the change to CodeQL alert 236 in the top-up success server action.

Verification

N/A - log-safety-only server action change with no practical manual verification path.

Visual Changes

N/A

Reviewer Notes

Targets CodeQL alert 236 only.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The targeted fix for CodeQL alert 236 is correct, but three other format-string log calls in the same function still interpolate the externally-controlled sessionId directly into template literals.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/app/payments/topup/success/actions.tsx	13–14, 18, 46	Three remaining console.info calls still interpolate sessionId via template literals, leaving the same class of tainted-format-string exposure that this PR is fixing on line 44.

Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File	Lines	Issue
apps/web/src/app/payments/topup/success/actions.tsx	13–14	console.info(\Fetching credit transaction ID for Stripe session: ${sessionId}`, ...)—sessionId` is string-interpolated into the format argument.
apps/web/src/app/payments/topup/success/actions.tsx	18	console.info(\Invalid sessionId: ${sessionId}`)` — same pattern.
apps/web/src/app/payments/topup/success/actions.tsx	46	console.info(\No credit transaction found for session ${sessionId}`)— same pattern. Should beconsole.info('No credit transaction found for session:', sessionId)` to be consistent with the fix on line 44.

Files Reviewed (1 file)

• apps/web/src/app/payments/topup/success/actions.tsx — 1 issue

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-4.6-sonnet-20260217 · 355,883 tokens}

_{Review guidance: REVIEW.md from base branch main}