#logout link

The token in question is not a sensitive token, in fact it was explicitly added to prevent a security issue. It is a CSRF token designed to ensure that the user actually requested the log out function and this has not been induced by an attacker.

If you are able to perform an attack using this token, please provide further information to the security team in private by following the instructions here: https://www.drupal.org/docs/develop/issues/issue-procedures-and-etiquett... → - do not post any sensitive information in this public issue.