There is no Sentry/Bugsnag/etc. integration yet — but given the eventual need for one, and that this codebase handles a live Stellar secret in memory during signing, retroactively bolting on PII/secret scrubbing after a reporter ships is how leaks happen. Specify the guardrail architecture now: an allowlist-based breadcrumb/context filter (not a denylist, which always misses a field eventually), and a lint rule or code-review checklist item blocking any crash-reporter setContext/setExtra call outside the vetted wrapper.
Definition of done:
- Written policy: allowlist approach specified, denylist approach explicitly rejected with rationale
- A wrapper module that is the only sanctioned way to attach context to error reports, reviewed for secret-safety
- A test that asserts a payload containing something matching a Stellar-secret-shaped string (
S + 55 base32 chars) is never present in any reporter payload the wrapper produces
Before opening a PR for this issue, read CONTRIBUTING.md.
This is not a starter-issue. The Definition of done above is the full
acceptance criteria, not a subset to sample from — a PR that addresses part
of it is an unfinished issue, not a smaller one. Your PR must include, in
the PR description itself:
PRs missing these will be sent back before review, not reviewed and rejected — please do this up front.
There is no Sentry/Bugsnag/etc. integration yet — but given the eventual need for one, and that this codebase handles a live Stellar secret in memory during signing, retroactively bolting on PII/secret scrubbing after a reporter ships is how leaks happen. Specify the guardrail architecture now: an allowlist-based breadcrumb/context filter (not a denylist, which always misses a field eventually), and a lint rule or code-review checklist item blocking any crash-reporter
setContext/setExtracall outside the vetted wrapper.Definition of done:
S+ 55 base32 chars) is never present in any reporter payload the wrapper producesBefore opening a PR for this issue, read CONTRIBUTING.md.
This is not a starter-issue. The Definition of done above is the full
acceptance criteria, not a subset to sample from — a PR that addresses part
of it is an unfinished issue, not a smaller one. Your PR must include, in
the PR description itself:
PRs missing these will be sent back before review, not reviewed and rejected — please do this up front.