@lavarage/telemetry 1.2.1 → 1.2.2

package/dist/index.js

@@ -43,6 +43,19 @@ class LavarageTelemetry {
         }
         try {
             const win = window;
+            // Check for Solana wallets FIRST (since they're more specific and users might have both)
+            if (win.solana) {
+                // Phantom
+                if (win.solana.isPhantom) {
+                    return 'Phantom';
+                }
+                // Solflare
+                if (win.solana.isSolflare) {
+                    return 'Solflare';
+                }
+                // Generic Solana
+                return 'Solana';
+            }
             // Check for Ethereum wallets
             if (win.ethereum) {
                 // MetaMask
@@ -80,19 +93,6 @@ class LavarageTelemetry {
                 // Default to generic Ethereum
                 return 'Ethereum';
             }
-            // Check for Solana wallets
-            if (win.solana) {
-                // Phantom
-                if (win.solana.isPhantom) {
-                    return 'Phantom';
-                }
-                // Solflare
-                if (win.solana.isSolflare) {
-                    return 'Solflare';
-                }
-                // Generic Solana
-                return 'Solana';
-            }
             // Check for other wallet providers
             if (win.web3) {
                 return 'Web3';
@@ -271,10 +271,27 @@ class LavarageTelemetry {
         }
         if (typeof data === 'object') {
             const sanitized = {};
-            const sensitiveKeys = ['privateKey', 'mnemonic', 'password', 'secret', 'token', 'apiKey', 'authorization'];
+            // Exact matches for sensitive keys
+            const exactSensitiveKeys = ['privateKey', 'mnemonic', 'password', 'secret', 'apiKey', 'authorization'];
+            // Patterns that indicate sensitive tokens (but not identifiers like baseToken, quoteToken)
+            const sensitiveTokenPatterns = [
+                /^access[_-]?token$/i,
+                /^auth[_-]?token$/i,
+                /^api[_-]?token$/i,
+                /^bearer[_-]?token$/i,
+                /^refresh[_-]?token$/i,
+                /^session[_-]?token$/i,
+                /^token$/i, // Only exact match for "token"
+            ];
             for (const [key, value] of Object.entries(data)) {
                 const lowerKey = key.toLowerCase();
-                const isSensitive = sensitiveKeys.some(sk => lowerKey.includes(sk.toLowerCase()));
+                // Check for exact matches first
+                const isExactMatch = exactSensitiveKeys.some(sk => lowerKey === sk.toLowerCase());
+                // Check for sensitive token patterns (but exclude common non-sensitive patterns)
+                const isSensitiveToken = sensitiveTokenPatterns.some(pattern => pattern.test(key));
+                // Exclude common non-sensitive patterns that contain "token"
+                const isNonSensitiveToken = /^(base|quote|tokenId|tokenAddress|tokenSymbol|tokenName|tokenUri|tokenType|tokenContract|tokenDecimals)/i.test(key);
+                const isSensitive = isExactMatch || (isSensitiveToken && !isNonSensitiveToken);
                 if (isSensitive) {
                     sanitized[key] = '[REDACTED]';
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lavarage/telemetry",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "Production telemetry SDK for Lavarage and partner applications",
   "main": "dist/index.js",
   "module": "dist/index.js",