@logbrew/sdk 0.1.5 → 0.1.6

package/README.md

@@ -585,7 +585,7 @@ logger.error(new Error("payment failed"), "checkout failed");
 await destination.flush();
 ```
 
-The Pino adapter reads JSON log lines, maps Pino `trace`/`debug` to LogBrew `info`, `warn` to `warning`, `error` to `error`, and `fatal` to `critical`, captures primitive Pino fields as `context.*`, captures serialized error name/message, skips noisy runtime defaults, and omits stack text unless `includeErrorStack: true` is set. It does not patch Pino or replace application logger ownership.
+The Pino adapter reads JSON log lines, maps Pino `trace`/`debug` to LogBrew `info`, `warn` to `warning`, `error` to `error`, and `fatal` to `critical`, captures safe primitive Pino fields as `context.*`, captures serialized error name/message, skips noisy runtime defaults, and omits stack text unless `includeErrorStack: true` is set. Credential, authorization, cookie, body, payload, query, raw-URL, propagation-header, local-path, and stack fields are excluded even when they are primitive. It does not patch Pino or replace application logger ownership. The log message itself is telemetry, so retain normal Pino redaction and keep secrets or user-entered text out of messages.
 
 When the app also uses a LogBrew Node or framework request helper, pass `traceProvider: getActiveLogBrewTrace` from `@logbrew/node` to add the current active `traceId`, `spanId`, optional `parentSpanId`, and `sampled` flag to each captured log. The provider is called per record, invalid or missing contexts are ignored, and no raw propagation headers, request data, payloads, or stack traces are captured.
 

package/core.cjs

@@ -28,6 +28,44 @@ const CONSOLE_METHODS = new Set(["debug", "info", "log", "warn", "error"]);
 const DEFAULT_CONSOLE_LEVELS = ["debug", "info", "log", "warn", "error"];
 const PINO_HOST_FIELD = ["host", "name"].join("");
 const PINO_RESERVED_FIELDS = new Set(["level", "time", "timestamp", "msg", "message", "err", "error", "pid", PINO_HOST_FIELD, "v"]);
+const PINO_SENSITIVE_CONTEXT_FIELDS = new Set([
+  "apikey",
+  "authorization",
+  "baggage",
+  "body",
+  "cookie",
+  "credentials",
+  "cwd",
+  "directory",
+  "dirname",
+  "errorstack",
+  "file",
+  "filename",
+  "filepath",
+  "headers",
+  "href",
+  "key",
+  "password",
+  "payload",
+  "proxyauthorization",
+  "query",
+  "querystring",
+  "requestbody",
+  "requestheaders",
+  "requesturl",
+  "responsebody",
+  "responseheaders",
+  "responseurl",
+  "search",
+  "secret",
+  "setcookie",
+  "stack",
+  "token",
+  "traceparent",
+  "tracestate",
+  "uri",
+  "url"
+]);
 const TRACEPARENT_PATTERN = /^([0-9a-fA-F]{2})-([0-9a-fA-F]{32})-([0-9a-fA-F]{16})-([0-9a-fA-F]{2})$/u;
 const ZERO_TRACE_ID = "00000000000000000000000000000000";
 const ZERO_SPAN_ID = "0000000000000000";
@@ -1798,13 +1836,35 @@ function pinoMessage(record) {
 function pinoContextMetadata(record) {
   const metadata = {};
   for (const [key, value] of Object.entries(record)) {
-    if (!PINO_RESERVED_FIELDS.has(key) && isMetadataValue(value)) {
+    if (!PINO_RESERVED_FIELDS.has(key) && !isSensitivePinoContextField(key) && isMetadataValue(value)) {
       metadata[`context.${key}`] = value;
     }
   }
   return metadata;
 }
 
+function isSensitivePinoContextField(key) {
+  const normalized = key.toLowerCase().replace(/[^a-z0-9]+/gu, "");
+  return (
+    PINO_SENSITIVE_CONTEXT_FIELDS.has(normalized)
+    || normalized.endsWith("accesskey")
+    || normalized.endsWith("apikey")
+    || normalized.endsWith("authorization")
+    || normalized.endsWith("body")
+    || normalized.endsWith("cookie")
+    || normalized.endsWith("credentials")
+    || normalized.endsWith("headers")
+    || normalized.endsWith("password")
+    || normalized.endsWith("payload")
+    || normalized.endsWith("privatekey")
+    || normalized.endsWith("query")
+    || normalized.endsWith("secret")
+    || normalized.endsWith("stack")
+    || normalized.endsWith("token")
+    || normalized.endsWith("url")
+  );
+}
+
 function addPinoErrorMetadata(metadata, error, includeErrorStack) {
   if (!error) {
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logbrew/sdk",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Public LogBrew JavaScript SDK for building, validating, and flushing event batches.",
   "type": "module",
   "main": "./index.cjs",