What happens if someone is sniffing the line? It wouldn't even need to be your fault, it could be some logger on your customer's server... i.e. do you have any

What happens if someone is sniffing the line? It wouldn't even need to be your fault, it could be some logger on your customer's server... i.e. do you have any protection against someone including this in the client code: DEBUG("testing external service... " + Hash1) Salt2 = call_external_salt_service_api(Hash1) DEBUG("service returned: " + Salt2) If someone was logging this traffic, wouldn't this allow your service to be treated as a black box and nullify any additional security? They wouldn't need to steal the full pool in this case, as you are sending back the exact hash/salt values needed for every user that logs in.