fix(payments): avoid tainted log format string

[kilo-code-bot]

Summary

• Resolve CodeQL alert 235 by keeping the console.info format string static when logging the Stripe checkout session lookup.
• Preserve the existing logged session id and timestamp as separate arguments so attacker-controlled % sequences cannot affect formatting.

Verification

N/A - backend log-format safety change only; no manual user flow exercised.

Visual Changes

N/A

Reviewer Notes

CodeQL alert: https://github.com/Kilo-Org/cloud/security/code-scanning/235

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The targeted fix correctly separates the format string from sessionId in the patched log call, but the same tainted log-format-string pattern remains in three other console.info calls in the same file that were not updated.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/app/payments/topup/success/actions.tsx	18, 42, 44	Same tainted log-format-string pattern as the CodeQL finding — template literals embedding sessionId (attacker-controlled input) passed as the first argument to console.info. Lines 18, 42, and 44 were not updated by this PR but are logically identical to the fixed call and may trigger the same CodeQL rule. Recommend applying the same fix: split each into a static format string + separate sessionId argument, e.g. console.info('Invalid sessionId:', sessionId)

Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File	Line	Issue
apps/web/src/app/payments/topup/success/actions.tsx	18	console.info(\Invalid sessionId: ${sessionId}`)` — identical tainted format string pattern, not fixed by this PR
apps/web/src/app/payments/topup/success/actions.tsx	42	console.info(\Found credit transaction for session ${sessionId}:`, ...)` — same pattern
apps/web/src/app/payments/topup/success/actions.tsx	44	console.info(\No credit transaction found for session ${sessionId}`)` — same pattern

Files Reviewed (1 file)

• apps/web/src/app/payments/topup/success/actions.tsx - 1 issue (in unchanged lines)

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-4.6-sonnet-20260217 · 354,860 tokens}

_{Review guidance: REVIEW.md from base branch main}