securenow 8.11.0 → 8.11.2

package/NPM_README.md

@@ -1307,7 +1307,7 @@ all runtime settings from this JSON plus built-in defaults. Production should
 mount a tokenless runtime credentials file at `.securenow/credentials.json`.
 Environment-variable fallback is not supported.
 
-**Default sensitive fields (auto-redacted):** `password`, `passwd`, `pwd`, `secret`, `token`, `api_key`, `apikey`, `access_token`, `auth`, `credentials`, `mysql_pwd`, `stripeToken`, `card`, `cardnumber`, `ccv`, `cvc`, `cvv`, `ssn`, `pin`
+**Default sensitive fields (auto-redacted):** `password`, `passwd`, `pwd`, `secret`, `token`, `api_key`, `apikey`, `access_token`, `auth`, `credentials`, `mysql_pwd`, `stripeToken`, `card`, `cardnumber`, `ccv`, `cvc`, `cvv`, `ssn`, `pin`, `code`, `otpCode`, `oneTimeCode`, `verificationCode`, `passcode`
 
 For instrumentation, firewall layers, debugging, trusted proxies, and deployment
 environment, edit the matching `config.*` keys in `.securenow/runtime.json`
@@ -1450,6 +1450,8 @@ File binary content is never stored in traces.
 
 ### Sensitive Data Redaction
 
+SecureNow 8.11.2 redacts sign-in credentials named `code`, `otpCode`, `oneTimeCode`, `verificationCode`, and `passcode` by default, including case and separator variants. JSON, form, GraphQL, and multipart text capture use the same rule; URL query parameters and captured headers are also protected. Credential names match exactly after normalization, so `status_code` and `error_code` remain available for investigation. Redaction changes exported telemetry only.
+
 All request bodies are automatically scanned and sensitive fields are redacted:
 
 **Automatically redacted fields:** `password`, `secret`, `token`, `api_key`, `card`, `cvv`, `ssn`, and more.

package/README.md

@@ -228,6 +228,8 @@ It syncs your app's blocklist plus SecureNow's IP database of 500k+ known-bad IP
 
 - **SecureNow never needs your source code.** It sees runtime telemetry — requests, spans, logs — not your repository.
 - **Redacted at capture.** `password`, `token`, `api_key`, `authorization`, `cookie`, and friends are auto-redacted before leaving your process; multipart file content is never captured. Preview with `securenow redact '<json>'`.
+
+  SecureNow 8.11.2 redacts sign-in credentials named `code`, `otpCode`, `oneTimeCode`, `verificationCode`, and `passcode` by default, including case and separator variants. JSON, form, GraphQL, and multipart text capture use the same rule; URL query parameters and captured headers are also protected. Credential names match exactly after normalization, so `status_code` and `error_code` remain available for investigation. Redaction changes exported telemetry only.
 - **Fails open.** If SecureNow is unreachable, your app serves traffic normally (`config.firewall.failMode: "open"` is the default).
 - **Read/write split.** MCP read tools are read-only; write tools require explicit `confirm: true` plus a reason, and human approval is the designed path for mutations — blocks, rate limits, and revocations are proposed, approved, executed, and reversible.
 

package/SKILL-API.md

@@ -542,6 +542,8 @@ securenow cidr parse 10.0.0.0/8                             # network/broadcast/
 
 ## Sensitive Data Redaction
 
+SecureNow 8.11.2 redacts sign-in credentials named `code`, `otpCode`, `oneTimeCode`, `verificationCode`, and `passcode` by default, including case and separator variants. JSON, form, GraphQL, and multipart text capture use the same rule; URL query parameters and captured headers are also protected. Credential names match exactly after normalization, so `status_code` and `error_code` remain available for investigation. Redaction changes exported telemetry only.
+
 Available from multiple entry points (`securenow/nextjs-middleware`, `securenow/nextjs-wrapper`, `securenow/nextjs-auto-capture`):
 
 ```javascript
@@ -551,7 +553,7 @@ const safe = redactSensitiveData({ username: 'alice', password: 's3cret', token:
 // { username: 'alice', password: '[REDACTED]', token: '[REDACTED]' }
 ```
 
-**Auto-redacted fields:** `password`, `passwd`, `pwd`, `secret`, `token`, `api_key`, `apikey`, `access_token`, `auth`, `credentials`, `mysql_pwd`, `stripeToken`, `card`, `cardnumber`, `ccv`, `cvc`, `cvv`, `ssn`, `pin`.
+**Auto-redacted fields:** `password`, `passwd`, `pwd`, `secret`, `token`, `api_key`, `apikey`, `access_token`, `auth`, `credentials`, `mysql_pwd`, `stripeToken`, `card`, `cardnumber`, `ccv`, `cvc`, `cvv`, `ssn`, `pin`, `code`, `otpCode`, `oneTimeCode`, `verificationCode`, `passcode`.
 
 Add custom fields via `config.capture.sensitiveFields` in `.securenow/runtime.json`.
 

package/SKILL-CLI.md

@@ -538,7 +538,9 @@ securenow test-span "ci.smoke-test"          # custom span name
 
 Both commands use the default SecureNow ingestion gateway plus optional advanced `config.otel.*` overrides from `.securenow/runtime.json` or legacy runtime credentials, and return non-zero on HTTP errors so CI/cron can detect failures.
 
-### Utilities — Redaction, CIDR, Diagnostics
+### Utilities — Redaction, CIDR, Diagnostics
+
+The `redact` command also hides OTP credentials named `code`, `oneTimeCode`, `verificationCode`, and `passcode` (case/separator variants included), while preserving `status_code` and `error_code`. SDK capture uses the same defaults.
 
 These mirror the SDK exports (`redactSensitiveData`, `createMatcher`, `parseCidr`) so agents can validate behavior without writing Node.
 

package/cli.js

@@ -671,7 +671,7 @@ const COMMANDS = {
     run: (rawArgs) => require('./cli/run').run(rawArgs),
   },
   redact: {
-    desc: 'Redact sensitive fields from a JSON payload',
+    desc: 'Redact sensitive fields and OTP codes from a JSON payload',
     usage: "securenow redact '<json>' [--fields f1,f2] [--json]",
     flags: { fields: 'Comma-separated extra field names to redact (added to defaults)' },
     run: (a, f) => require('./cli/utils').redact(a, f),

package/firewall-only.js

@@ -1,5 +1,8 @@
 'use strict';
 
+// Do nothing inside Node's internal ESM-hooks thread (see internal-thread.js).
+if (require('./internal-thread').inInternalThread()) return;
+
 /**
  * Standalone firewall preload — no OpenTelemetry, no tracing.
  *
@@ -7,35 +10,35 @@
  *   node -r securenow/firewall-only app.js
  *   NODE_OPTIONS='-r securenow/firewall-only' next start
  *
- * Reads SecureNow runtime credentials from .securenow/*.json. Initialises the
- * HTTP-level firewall when a snk_live_ API key is resolvable.
- */
-
-const appConfig = require('./app-config');
-const firewallOptions = appConfig.resolveFirewallOptions();
+ * Reads SecureNow runtime credentials from .securenow/*.json. Initialises the
+ * HTTP-level firewall when a snk_live_ API key is resolvable.
+ */
+
+const appConfig = require('./app-config');
+const firewallOptions = appConfig.resolveFirewallOptions();
 
-// Runtime enable/disable is controlled by the dashboard/API toggle. If a
-// firewall key is present, start sync so the remote toggle can be applied.
-if (firewallOptions.apiKey) {
-  require('./firewall').init({
-    apiKey: firewallOptions.apiKey,
-    appKey: firewallOptions.appKey,
-    environment: firewallOptions.environment,
-    apiUrl: firewallOptions.apiUrl,
-    apiUrlFallbacks: firewallOptions.apiUrlFallbacks,
-    versionCheckInterval: firewallOptions.versionCheckInterval,
-    syncInterval: firewallOptions.syncInterval,
-    failMode: firewallOptions.failMode,
-    statusCode: firewallOptions.statusCode,
-    log: firewallOptions.log,
-    tcp: firewallOptions.tcp,
-    iptables: firewallOptions.iptables,
-    cloud: firewallOptions.cloud,
-    cloudDryRun: firewallOptions.cloudDryRun,
-    cloudflare: firewallOptions.cloudflare,
-    aws: firewallOptions.aws,
-    gcp: firewallOptions.gcp,
-  });
+// Runtime enable/disable is controlled by the dashboard/API toggle. If a
+// firewall key is present, start sync so the remote toggle can be applied.
+if (firewallOptions.apiKey) {
+  require('./firewall').init({
+    apiKey: firewallOptions.apiKey,
+    appKey: firewallOptions.appKey,
+    environment: firewallOptions.environment,
+    apiUrl: firewallOptions.apiUrl,
+    apiUrlFallbacks: firewallOptions.apiUrlFallbacks,
+    versionCheckInterval: firewallOptions.versionCheckInterval,
+    syncInterval: firewallOptions.syncInterval,
+    failMode: firewallOptions.failMode,
+    statusCode: firewallOptions.statusCode,
+    log: firewallOptions.log,
+    tcp: firewallOptions.tcp,
+    iptables: firewallOptions.iptables,
+    cloud: firewallOptions.cloud,
+    cloudDryRun: firewallOptions.cloudDryRun,
+    cloudflare: firewallOptions.cloudflare,
+    aws: firewallOptions.aws,
+    gcp: firewallOptions.gcp,
+  });
 
   const shutdown = () => { try { require('./firewall').shutdown(); } catch (_) {} };
   process.on('SIGINT', shutdown);

package/internal-thread.js

@@ -0,0 +1,22 @@
+'use strict';
+
+/**
+ * Node runs --require preloads inside its internal module-customization-hooks
+ * thread too (the worker module.register() starts for ESM loader hooks). The
+ * SecureNow preloads must only initialize in application threads: in that
+ * internal thread they started a second OpenTelemetry SDK and a second firewall
+ * poller, and registered the ESM hook twice ("The 'import-in-the-middle' hook
+ * has already been initialized").
+ *
+ * worker_threads.isInternalThread exists on Node >= 22.14 / 23.7. Older Node has
+ * no reliable way to tell that thread from a user Worker, so nothing changes there.
+ */
+function inInternalThread() {
+  try {
+    return require('node:worker_threads').isInternalThread === true;
+  } catch (_) {
+    return false;
+  }
+}
+
+module.exports = { inInternalThread };

package/legacy-semconv.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { isOtpCodeField } = require('./otp-redaction');
+
 /**
  * Legacy semantic-convention attributes for the OpenTelemetry 0.221+ /
  * contrib 0.74+ instrumentations, which emit ONLY the stable conventions.
@@ -24,7 +26,7 @@
  *  - http.client_ip is NOT derived from the first X-Forwarded-For entry (that
  *    value is spoofable). SecureNow's requestHook sets http.client_ip from the
  *    trusted-proxy resolver (resolve-ip.js).
- *  - Signature-style query parameters (same list upstream now redacts on
+ *  - OTP/code and signature-style query parameters (same list upstream redacts on
  *    url.query / url.full) are replaced with REDACTED in http.target / http.url.
  *    Every other byte of the target is kept exactly as received, so detection
  *    rules that match encoded payloads keep working.
@@ -62,7 +64,6 @@ function defined(attributes) {
 function redactSearch(search, paramsToRedact = DEFAULT_REDACTED_QUERY_PARAMS) {
   if (typeof search !== 'string' || search.length < 2 || search[0] !== '?') return search;
   const sensitive = new Set(paramsToRedact || []);
-  if (sensitive.size === 0) return search;
   let changed = false;
   const parts = search.slice(1).split('&').map((part) => {
     const eq = part.indexOf('=');
@@ -71,7 +72,7 @@ function redactSearch(search, paramsToRedact = DEFAULT_REDACTED_QUERY_PARAMS) {
     try {
       key = decodeURIComponent(rawKey.replace(/\+/g, ' '));
     } catch (_) {}
-    if (!sensitive.has(key)) return part;
+    if (!sensitive.has(key) && !isOtpCodeField(key)) return part;
     changed = true;
     return `${rawKey}=${REDACTED}`;
   });

package/nextjs-auto-capture.js

@@ -19,14 +19,18 @@
 const { trace } = require('@opentelemetry/api');
 const appConfig = require('./app-config');
 
+const { OTP_SENSITIVE_FIELDS, matchesSensitiveField, redactOtpGraphQL, redactOtpQuery } = require('./otp-redaction');
+
 // Default sensitive fields to redact from request bodies.
-// Matched substring-wise against lowercased keys (see redactSensitiveData),
+// OTP/code aliases use exact normalized matching; other fields are matched
+// substring-wise against lowercased keys (see redactSensitiveData),
 // so e.g. 'card' also catches 'creditCard' and 'account' also catches
 // 'accountNumber'. Over-redaction here is intentional: a falsely-redacted
 // telemetry value is always safer than a leaked secret. Entries are kept
 // specific enough to avoid nuking broad benign keys (e.g. we use
 // 'firstname'/'lastname'/'fullname', never bare 'name').
-const DEFAULT_SENSITIVE_FIELDS = [
+const DEFAULT_SENSITIVE_FIELDS = [
+  ...OTP_SENSITIVE_FIELDS,
   // credentials / auth
   'password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey',
   'access_token', 'auth', 'authorization', 'bearer', 'credentials',
@@ -84,7 +88,10 @@ function luhnValid(digits) {
  */
 function redactSensitiveValue(value) {
   if (typeof value !== 'string' || value.length === 0) return value;
-  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound the work
+  // Credential assignments in GraphQL/query strings need field-aware
+  // redaction even though a short numeric OTP has no unique value shape.
+  value = redactOtpQuery(redactOtpGraphQL(value));
+  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
   let out = value;
   for (const r of VALUE_REDACTORS) {
     r.re.lastIndex = 0;
@@ -110,9 +117,8 @@ function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
   const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
 
   for (const key of Object.keys(redacted)) {
-    const lowerKey = key.toLowerCase();
 
-    if (sensitiveFields.some(field => lowerKey.includes(field.toLowerCase()))) {
+    if (matchesSensitiveField(key, sensitiveFields)) {
       redacted[key] = '[REDACTED]';
     } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
       redacted[key] = redactSensitiveData(redacted[key], sensitiveFields);

package/nextjs-middleware.js

@@ -18,14 +18,18 @@
 const { trace, context, SpanStatusCode } = require('@opentelemetry/api');
 const appConfig = require('./app-config');
 
+const { OTP_SENSITIVE_FIELDS, isOtpCodeField, matchesSensitiveField, redactOtpGraphQL, redactOtpQuery } = require('./otp-redaction');
+
 // Default sensitive fields to redact from request bodies.
-// Matched substring-wise against lowercased keys (see redactSensitiveData),
+// OTP/code aliases use exact normalized matching; other fields are matched
+// substring-wise against lowercased keys (see redactSensitiveData),
 // so e.g. 'card' also catches 'creditCard' and 'account' also catches
 // 'accountNumber'. Over-redaction here is intentional: a falsely-redacted
 // telemetry value is always safer than a leaked secret. Entries are kept
 // specific enough to avoid nuking broad benign keys (e.g. we use
 // 'firstname'/'lastname'/'fullname', never bare 'name').
-const DEFAULT_SENSITIVE_FIELDS = [
+const DEFAULT_SENSITIVE_FIELDS = [
+  ...OTP_SENSITIVE_FIELDS,
   // credentials / auth
   'password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey',
   'access_token', 'auth', 'authorization', 'bearer', 'credentials',
@@ -83,7 +87,10 @@ function luhnValid(digits) {
  */
 function redactSensitiveValue(value) {
   if (typeof value !== 'string' || value.length === 0) return value;
-  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound the work
+  // Credential assignments in GraphQL/query strings need field-aware
+  // redaction even though a short numeric OTP has no unique value shape.
+  value = redactOtpQuery(redactOtpGraphQL(value));
+  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
   let out = value;
   for (const r of VALUE_REDACTORS) {
     r.re.lastIndex = 0;
@@ -113,9 +120,8 @@ function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
   const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
 
   for (const key of Object.keys(redacted)) {
-    const lowerKey = key.toLowerCase();
 
-    if (sensitiveFields.some(field => lowerKey.includes(field.toLowerCase()))) {
+    if (matchesSensitiveField(key, sensitiveFields)) {
       redacted[key] = '[REDACTED]';
     } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
       redacted[key] = redactSensitiveData(redacted[key], sensitiveFields);
@@ -137,7 +143,7 @@ function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
   
   let redacted = query;
   
-  sensitiveFields.forEach(field => {
+  sensitiveFields.filter(field => field === 'otp' || !isOtpCodeField(field)).forEach(field => {
     const escaped = escapeRegex(field);
     const patterns = [
       new RegExp(`(${escaped}\\s*:\\s*["'])([^"']+)(["'])`, 'gi'),
@@ -153,7 +159,7 @@ function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
 
   // Second layer: scrub secret/PII *shapes* anywhere in the (free-form) query
   // body — catches values the key-name pass above can't see.
-  redacted = redactSensitiveValue(redacted);
+  redacted = redactOtpGraphQL(redactSensitiveValue(redacted));
 
   return redacted;
 }

package/nextjs-wrapper.js

@@ -18,14 +18,18 @@
 const { trace } = require('@opentelemetry/api');
 const appConfig = require('./app-config');
 
+const { OTP_SENSITIVE_FIELDS, matchesSensitiveField, redactOtpGraphQL, redactOtpQuery } = require('./otp-redaction');
+
 // Default sensitive fields to redact from request bodies.
-// Matched substring-wise against lowercased keys (see redactSensitiveData),
+// OTP/code aliases use exact normalized matching; other fields are matched
+// substring-wise against lowercased keys (see redactSensitiveData),
 // so e.g. 'card' also catches 'creditCard' and 'account' also catches
 // 'accountNumber'. Over-redaction here is intentional: a falsely-redacted
 // telemetry value is always safer than a leaked secret. Entries are kept
 // specific enough to avoid nuking broad benign keys (e.g. we use
 // 'firstname'/'lastname'/'fullname', never bare 'name').
-const DEFAULT_SENSITIVE_FIELDS = [
+const DEFAULT_SENSITIVE_FIELDS = [
+  ...OTP_SENSITIVE_FIELDS,
   // credentials / auth
   'password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey',
   'access_token', 'auth', 'authorization', 'bearer', 'credentials',
@@ -83,7 +87,10 @@ function luhnValid(digits) {
  */
 function redactSensitiveValue(value) {
   if (typeof value !== 'string' || value.length === 0) return value;
-  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound the work
+  // Credential assignments in GraphQL/query strings need field-aware
+  // redaction even though a short numeric OTP has no unique value shape.
+  value = redactOtpQuery(redactOtpGraphQL(value));
+  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
   let out = value;
   for (const r of VALUE_REDACTORS) {
     r.re.lastIndex = 0;
@@ -109,9 +116,8 @@ function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
   const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
 
   for (const key of Object.keys(redacted)) {
-    const lowerKey = key.toLowerCase();
 
-    if (sensitiveFields.some(field => lowerKey.includes(field.toLowerCase()))) {
+    if (matchesSensitiveField(key, sensitiveFields)) {
       redacted[key] = '[REDACTED]';
     } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
       redacted[key] = redactSensitiveData(redacted[key], sensitiveFields);

package/nextjs.js

@@ -59,14 +59,18 @@ function createResource(attributes) {
   throw new Error('Unsupported @opentelemetry/resources version');
 }
 
+const { OTP_SENSITIVE_FIELDS, isOtpCodeField, matchesSensitiveField, redactOtpGraphQL, redactOtpQuery, withOtpRedactionExporter } = require('./otp-redaction');
+
 // Default sensitive fields to redact from request bodies.
-// Matched substring-wise against lowercased keys (see redactSensitiveData),
+// OTP/code aliases use exact normalized matching; other fields are matched
+// substring-wise against lowercased keys (see redactSensitiveData),
 // so e.g. 'card' also catches 'creditCard' and 'account' also catches
 // 'accountNumber'. Over-redaction here is intentional: a falsely-redacted
 // telemetry value is always safer than a leaked secret. Entries are kept
 // specific enough to avoid nuking broad benign keys (e.g. we use
 // 'firstname'/'lastname'/'fullname', never bare 'name').
 const DEFAULT_SENSITIVE_FIELDS = [
+  ...OTP_SENSITIVE_FIELDS,
   // credentials / auth
   'password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey',
   'access_token', 'auth', 'authorization', 'bearer', 'credentials',
@@ -124,7 +128,10 @@ function luhnValid(digits) {
  */
 function redactSensitiveValue(value) {
   if (typeof value !== 'string' || value.length === 0) return value;
-  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound the work
+  // Credential assignments in GraphQL/query strings need field-aware
+  // redaction even though a short numeric OTP has no unique value shape.
+  value = redactOtpQuery(redactOtpGraphQL(value));
+  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
   let out = value;
   for (const r of VALUE_REDACTORS) {
     r.re.lastIndex = 0;
@@ -150,9 +157,8 @@ function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
   const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
 
   for (const key of Object.keys(redacted)) {
-    const lowerKey = key.toLowerCase();
 
-    if (sensitiveFields.some(field => lowerKey.includes(field.toLowerCase()))) {
+    if (matchesSensitiveField(key, sensitiveFields)) {
       redacted[key] = '[REDACTED]';
     } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
       // Recursively redact nested objects
@@ -181,7 +187,7 @@ function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
   
   // Redact sensitive fields in GraphQL arguments and variables
   // Matches patterns like: password: "value" or password:"value" or password:'value'
-  sensitiveFields.forEach(field => {
+  sensitiveFields.filter(field => field === 'otp' || !isOtpCodeField(field)).forEach(field => {
     const escaped = escapeRegex(field);
     const patterns = [
       new RegExp(`(${escaped}\\s*:\\s*["'])([^"']+)(["'])`, 'gi'),
@@ -201,7 +207,7 @@ function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
 
   // Second layer: scrub secret/PII *shapes* anywhere in the (free-form) query
   // body — catches values the key-name pass above can't see.
-  redacted = redactSensitiveValue(redacted);
+  redacted = redactOtpGraphQL(redactSensitiveValue(redacted));
 
   return redacted;
 }
@@ -320,7 +326,7 @@ function registerSecureNow(options = {}) {
           
           // ======== REQUEST METADATA ========
           const userAgent = headers['user-agent'] || '';
-          const referer = headers['referer'] || headers['referrer'] || '';
+          const referer = redactOtpQuery(headers['referer'] || headers['referrer'] || '');
           const accept = headers['accept'] || '';
           const acceptLanguage = headers['accept-language'] || '';
           const acceptEncoding = headers['accept-encoding'] || '';
@@ -329,7 +335,7 @@ function registerSecureNow(options = {}) {
           const origin = headers['origin'] || '';
           
           // ======== PROXY & LOAD BALANCER ========
-          const originalUri = headers['x-original-uri'] || '';
+          const originalUri = redactOtpQuery(headers['x-original-uri'] || '');
           const originalMethod = headers['x-original-method'] || '';
           const requestId = headers['x-request-id'] || headers['x-trace-id'] || headers['x-correlation-id'] || '';
           
@@ -528,6 +534,7 @@ function registerSecureNow(options = {}) {
       const { registerOTel } = require('@vercel/otel');
       
       registerOTel({
+        traceExporter: withOtpRedactionExporter(new (require('@opentelemetry/exporter-trace-otlp-http').OTLPTraceExporter)({ url: tracesUrl, headers })),
         serviceName: serviceName,
         attributes: {
           'deployment.environment': deploymentEnvironment,
@@ -558,10 +565,10 @@ function registerSecureNow(options = {}) {
       const { OTLPTraceExporter } = require('@opentelemetry/exporter-trace-otlp-http');
       const { SemanticResourceAttributes } = require('@opentelemetry/semantic-conventions');
       
-      const traceExporter = new OTLPTraceExporter({ 
+      const traceExporter = withOtpRedactionExporter(new OTLPTraceExporter({
         url: tracesUrl,
-            headers
-      });
+        headers
+      }));
       
       const sdk = new NodeSDK({
         ...nodeSdkTelemetryOptions,
@@ -643,7 +650,7 @@ function registerSecureNow(options = {}) {
               if (event === 'request' && req && res) {
                 const start = Date.now();
                 const method = req.method;
-                const url = req.url;
+                const url = redactOtpQuery(req.url);
                 res.on('finish', () => {
                   const reqCtx = otelContext.active();
                   const reqSpanCtx = otelTrace.getSpanContext(reqCtx);

package/nuxt-server-plugin.mjs

@@ -42,14 +42,18 @@ function createResource(attributes) {
   throw new Error('Unsupported @opentelemetry/resources version');
 }
 
+const { OTP_SENSITIVE_FIELDS, matchesSensitiveField, redactOtpQuery, withOtpRedactionExporter, redactOtpGraphQL } = nodeRequire('./otp-redaction');
+
 // Default sensitive fields to redact from request bodies.
-// Matched substring-wise against lowercased keys (see redactSensitiveData),
+// OTP/code aliases use exact normalized matching; other fields are matched
+// substring-wise against lowercased keys (see redactSensitiveData),
 // so e.g. 'card' also catches 'creditCard' and 'account' also catches
 // 'accountNumber'. Over-redaction here is intentional: a falsely-redacted
 // telemetry value is always safer than a leaked secret. Entries are kept
 // specific enough to avoid nuking broad benign keys (e.g. we use
 // 'firstname'/'lastname'/'fullname', never bare 'name').
 const DEFAULT_SENSITIVE_FIELDS = [
+  ...OTP_SENSITIVE_FIELDS,
   // credentials / auth
   'password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey',
   'access_token', 'auth', 'authorization', 'bearer', 'credentials',
@@ -107,7 +111,10 @@ function luhnValid(digits) {
  */
 function redactSensitiveValue(value) {
   if (typeof value !== 'string' || value.length === 0) return value;
-  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound the work
+  // Credential assignments in GraphQL/query strings need field-aware
+  // redaction even though a short numeric OTP has no unique value shape.
+  value = redactOtpQuery(redactOtpGraphQL(value));
+  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
   let out = value;
   for (const r of VALUE_REDACTORS) {
     r.re.lastIndex = 0;
@@ -128,8 +135,7 @@ function redactSensitiveData(obj, fields = DEFAULT_SENSITIVE_FIELDS) {
   if (!obj || typeof obj !== 'object') return obj;
   const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
   for (const key of Object.keys(redacted)) {
-    const lower = key.toLowerCase();
-    if (fields.some((f) => lower.includes(f.toLowerCase()))) {
+    if (matchesSensitiveField(key, fields)) {
       redacted[key] = '[REDACTED]';
     } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
       redacted[key] = redactSensitiveData(redacted[key], fields);
@@ -299,7 +305,7 @@ export default defineNitroPlugin(async (nitroApp) => {
   }));
 
   // ── Trace exporter + SDK ──
-  const traceExporter = new OTLPTraceExporter({ url: tracesUrl, headers });
+  const traceExporter = withOtpRedactionExporter(new OTLPTraceExporter({ url: tracesUrl, headers }));
 
   const sdk = new NodeSDK({
     ...nodeSdkTelemetryOptions,

package/otp-redaction.js

@@ -0,0 +1,99 @@
+'use strict';
+
+// Match credential names exactly after case/separator normalization. Treating
+// "code" as a substring would also hide status_code/error_code forensic data.
+const OTP_SENSITIVE_FIELDS = Object.freeze([
+  'code', 'otp', 'otpCode', 'oneTimeCode', 'oneTimePassword', 'passcode',
+  'verificationCode', 'confirmationCode', 'emailCode', 'smsCode', 'loginCode',
+  'signInCode', 'authCode', 'authenticationCode', 'mfaCode', 'totpCode', '2faCode',
+  'securityCode', 'recoveryCode', 'backupCode',
+]);
+const canonical = (key) => String(key).replace(/[^a-z0-9]/gi, '').toLowerCase();
+const OTP_NAMES = new Set(OTP_SENSITIVE_FIELDS.map(canonical));
+
+function isOtpCodeField(key) {
+  let name = String(key);
+  // Support individually captured header attributes and nested form keys.
+  name = name.replace(/^http\.(?:request|response)\.header[s]?\./i, '');
+  const nested = name.match(/(?:\[|\.)([^\[\].]+)\]?$/);
+  if (nested) name = nested[1];
+  name = name.replace(/^x[-_]/i, '');
+  return OTP_NAMES.has(canonical(name));
+}
+
+function matchesSensitiveField(key, fields) {
+  if (isOtpCodeField(key)) return true;
+  const lower = String(key).toLowerCase();
+  return fields.some((field) => (canonical(field) === 'otp' || !isOtpCodeField(field)) && lower.includes(String(field).toLowerCase()));
+}
+
+function redactOtpData(value) {
+  if (typeof value === 'string') return redactOtpQuery(redactOtpGraphQL(value));
+  if (!value || typeof value !== 'object') return value;
+  const out = Array.isArray(value) ? [...value] : { ...value };
+  for (const key of Object.keys(out)) {
+    out[key] = isOtpCodeField(key) ? '[REDACTED]' : redactOtpData(out[key]);
+  }
+  return out;
+}
+
+function redactOtpGraphQL(query) {
+  return query.replace(/\b([A-Za-z_][\w]*)(\s*:\s*)("(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,})]+)/g,
+    (match, key, separator) => isOtpCodeField(key) ? `${key}${separator}"[REDACTED]"` : match);
+}
+
+// Preserve the exact bytes of harmless query parameters, including attack
+// payloads. Also covers duplicate and percent-encoded credential keys.
+function redactOtpQuery(value, marker = 'REDACTED') {
+  if (typeof value !== 'string' || !value.includes('?')) return value;
+  return value.replace(/([?&])([^?&#=\s]+)=([^&#\s]*)/g, (part, separator, rawKey) => {
+    let key = rawKey;
+    try { key = decodeURIComponent(rawKey.replace(/\+/g, ' ')); } catch (_) {}
+    return isOtpCodeField(key) ? `${separator}${rawKey}=${marker}` : part;
+  });
+}
+
+function redactOtpAttributes(attributes = {}) {
+  const out = { ...attributes };
+  for (const [key, value] of Object.entries(out)) {
+    if (isOtpCodeField(key)) {
+      out[key] = '[REDACTED]';
+    } else if (typeof value === 'string') {
+      if (/^http\.(request|response)\.(body|headers|multipart\.fields)$/.test(key)) {
+        try {
+          // Scrub each string value before serializing. Running URL matching on
+          // the serialized JSON would consume closing quotes after query values.
+          out[key] = JSON.stringify(redactOtpData(JSON.parse(value)));
+          continue;
+        } catch (_) {}
+      }
+      out[key] = redactOtpQuery(out[key]);
+      // Stable URL semconv stores the query without a leading question mark.
+      if (key === 'url.query') out[key] = redactOtpQuery(`?${value}`).slice(1);
+    } else if (Array.isArray(value) && /^http\.(request|response)\.header\./.test(key)) {
+      out[key] = value.map((item) => redactOtpQuery(item));
+    }
+  }
+  return out;
+}
+
+// Export a view rather than mutating the completed span or the real request.
+// The final pass catches Next.js/Nitro/fetch attributes written after HTTP hooks.
+function withOtpRedactionExporter(exporter) {
+  return {
+    export(spans, callback) {
+      return exporter.export(spans.map((span) => Object.create(span, {
+        attributes: { value: redactOtpAttributes(span.attributes), enumerable: true },
+        name: { value: redactOtpQuery(span.name), enumerable: true },
+        events: { value: (span.events || []).map((event) => ({ ...event, attributes: redactOtpAttributes(event.attributes) })), enumerable: true },
+      })), callback);
+    },
+    shutdown: () => exporter.shutdown(),
+    forceFlush: () => typeof exporter.forceFlush === 'function' ? exporter.forceFlush() : Promise.resolve(),
+  };
+}
+
+module.exports = {
+  OTP_SENSITIVE_FIELDS, isOtpCodeField, matchesSensitiveField, redactOtpData,
+  redactOtpGraphQL, redactOtpQuery, redactOtpAttributes, withOtpRedactionExporter,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.11.0",
+  "version": "8.11.2",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",
@@ -10,7 +10,7 @@
     "securenow-mcp": "mcp/server.js"
   },
   "scripts": {
-    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-package-contents.js"
+    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-internal-thread.js && node test-package-contents.js"
   },
   "keywords": [
     "opentelemetry",
@@ -159,7 +159,9 @@
     "firewall.js",
     "challenge.js",
     "otel-defaults.js",
+    "internal-thread.js",
     "legacy-semconv.js",
+    "otp-redaction.js",
     "rate-limits.js",
     "rate-limits.d.ts",
     "firewall-only.js",