heimdall-sdk 0.1.0 → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Alessandro Amormino
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/interceptor.js

@@ -1,6 +1,49 @@
 function shouldIgnore(url, patterns) {
     return patterns.some(p => typeof p === 'string' ? url.includes(p) : p.test(url));
 }
+const SENSITIVE_URL_PARAMS = new Set([
+    'access_token', 'token', 'api_key', 'apikey', 'secret', 'key',
+    'auth', 'password', 'pass', 'pwd', 'client_secret', 'private_key',
+    'api_secret', 'api_token', 'client_id',
+]);
+const SENSITIVE_HEADERS = new Set([
+    'authorization', 'x-api-key', 'x-auth-token', 'x-access-token',
+    'x-secret', 'x-secret-key', 'x-token', 'x-auth', 'cookie',
+    'x-api-secret', 'x-private-key',
+]);
+const TOKEN_PATTERNS = [
+    /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, // JWT
+    /^(sk|pk)\.[A-Za-z0-9._-]{20,}/, // Mapbox
+    /^[a-f0-9]{32,}$/, // hex API key
+    /^[A-Za-z0-9+/]{40,}={0,2}$/, // base64
+];
+function looksLikeToken(value) {
+    return TOKEN_PATTERNS.some(p => p.test(value));
+}
+function scanForSecrets(url, headers) {
+    const warnings = [];
+    let safeUrl = url;
+    try {
+        const parsed = new URL(url);
+        parsed.searchParams.forEach((value, key) => {
+            if (SENSITIVE_URL_PARAMS.has(key.toLowerCase()) || looksLikeToken(value)) {
+                warnings.push(`Exposed secret in URL parameter "${key}"`);
+                parsed.searchParams.set(key, '[REDACTED]');
+            }
+        });
+        if (warnings.length > 0)
+            safeUrl = parsed.toString();
+    }
+    catch { /* relative URL */ }
+    const safeHeaders = { ...headers };
+    for (const [key, value] of Object.entries(headers)) {
+        if (SENSITIVE_HEADERS.has(key.toLowerCase()) || looksLikeToken(value)) {
+            warnings.push(`Exposed secret in header "${key}"`);
+            safeHeaders[key] = '[REDACTED]';
+        }
+    }
+    return { url: safeUrl, requestHeaders: safeHeaders, warnings };
+}
 function sendLog(collectorUrl, payload) {
     // Use the original fetch before we patch it
     const f = window.__heimdall_fetch;
@@ -37,7 +80,8 @@ export function patchFetch(config) {
                 requestBodyParsed = String(requestBody);
             }
         }
-        const requestHeaders = Object.fromEntries(new Headers(init?.headers ?? (input instanceof Request ? input.headers : {})).entries());
+        const rawHeaders = Object.fromEntries(new Headers(init?.headers ?? (input instanceof Request ? input.headers : {})).entries());
+        const scanned = scanForSecrets(url, rawHeaders);
         const start = performance.now();
         let response;
         try {
@@ -46,11 +90,12 @@ export function patchFetch(config) {
         catch (err) {
             sendLog(config.collectorUrl, {
                 method,
-                url,
+                url: scanned.url,
                 error: String(err),
                 duration_ms: Math.round(performance.now() - start),
-                request_headers: requestHeaders,
+                request_headers: scanned.requestHeaders,
                 request_body: requestBodyParsed,
+                security_warnings: scanned.warnings.length ? scanned.warnings : undefined,
                 project: config.project ?? 'default',
                 timestamp: new Date().toISOString(),
             });
@@ -72,13 +117,14 @@ export function patchFetch(config) {
         const responseHeaders = Object.fromEntries(response.headers.entries());
         sendLog(config.collectorUrl, {
             method,
-            url,
+            url: scanned.url,
             status_code: response.status,
             duration_ms: duration,
-            request_headers: requestHeaders,
+            request_headers: scanned.requestHeaders,
             request_body: requestBodyParsed,
             response_headers: responseHeaders,
             response_body: responseBody,
+            security_warnings: scanned.warnings.length ? scanned.warnings : undefined,
             project: config.project ?? 'default',
             timestamp: new Date().toISOString(),
         });

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "heimdall-sdk",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Heimdall SDK — zero-config API logger for React",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "license": "MIT",
   "files": ["dist"],
   "scripts": {
     "build": "tsc",