You
Check whether the new audit logging leaks sensitive fields.
Assistant
The logging change is safe to ship, with one fix.
audit.ts writes the full request body on 4xx responses, which includes the password field on /login. I added a redaction list and opened PR #531.
- Unit tests cover 6 sensitive field names.
- CI is green.
You
Which fields does the redaction cover?
Assistant
The redaction list covers these fields:
password,newPassword,tokenauthorization,cardNumber,ssn
Matching is case-insensitive and applies at any depth in the body.
You
Are there other places that log request bodies?
Assistant
Found 3 other places logging req.body, all behind debug level and disabled in production. I left them alone but they use the same helper pattern, so switching is a one-line change each.
You
Go ahead and switch those too.
Assistant
Yes, switched all three to the redaction helper and pushed to PR #531. CI is rerunning.