securenow 5.10.1 → 5.10.2

package/nuxt-server-plugin.mjs

@@ -46,7 +46,7 @@ const DEFAULT_SENSITIVE_FIELDS = [
 function redactSensitiveData(obj, fields = DEFAULT_SENSITIVE_FIELDS) {
   if (!obj || typeof obj !== 'object') return obj;
   const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
-  for (const key in redacted) {
+  for (const key of Object.keys(redacted)) {
     const lower = key.toLowerCase();
     if (fields.some((f) => lower.includes(f.toLowerCase()))) {
       redacted[key] = '[REDACTED]';
@@ -133,7 +133,7 @@ export default defineNitroPlugin((nitroApp) => {
     opts.captureBody ??
     (String(env('SECURENOW_CAPTURE_BODY')) === '1' ||
       String(env('SECURENOW_CAPTURE_BODY')).toLowerCase() === 'true');
-  const maxBodySize = parseInt(env('SECURENOW_MAX_BODY_SIZE') || '10240');
+  const maxBodySize = Math.max(1024, parseInt(env('SECURENOW_MAX_BODY_SIZE'), 10) || 10240);
   const customSensitiveFields = (env('SECURENOW_SENSITIVE_FIELDS') || '')
     .split(',')
     .map((s) => s.trim())
@@ -208,7 +208,7 @@ export default defineNitroPlugin((nitroApp) => {
                   'http.request.body.size': size,
                 });
               } catch {
-                span.setAttribute('http.request.body', raw.substring(0, 1000));
+                span.setAttribute('http.request.body', '[UNPARSEABLE - REDACTED FOR SAFETY]');
                 span.setAttribute('http.request.body.parse_error', true);
               }
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "5.10.1",
+  "version": "5.10.2",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",