The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
rivetkit-serverless	Ready	Preview	Comment	Oct 16, 2025 10:00am

• chore(example-next-js): update example to chat room #1402
• fix(core): fix path for auto-configure serverless #1401
• chore(example-next-js): configure frontend #1400
• chore(core): update engine runner #1399
• fix(next-js): disable health check by defualt #1398
• chore(core): log headers with _RIVET_LOG_HEADERS #1397 👈 (View in Graphite)
• chore(example-next-js): improve deployment #1396
• main

How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

• merge queue - adds this PR to the back of the merge queue
• hotfix - for urgent hot fixes, skip the queue and merge this PR next

You must have a Graphite account in order to use the merge queue. Sign up using this link.

This stack of pull requests is managed by Graphite. Learn more about stacking.

Claude finished @NathanFlurry's task —— View job

PR Code Review

Reviewing PR #1397: "chore(core): log headers with _RIVET_LOG_HEADERS"

Todo List:

• Read repository guidelines (CLAUDE.md)
• Analyze the modified file changes
• Review for code quality and best practices
• Check for potential bugs or issues
• Evaluate performance considerations
• Assess security concerns
• Check test coverage implications
• Provide comprehensive feedback

Changes Summary:

• File: packages/rivetkit/src/common/router.ts:40-42
• Lines: +4/-1 (imported getEnvUniversal and added conditional header logging)
• Purpose: Adds optional logging of all HTTP request headers when _RIVET_LOG_HEADERS environment variable is set

Code Review Feedback

✅ Code Quality & Best Practices

• Good: Follows repository logging guidelines (lowercase messages, structured logging)
• Good: Uses existing getEnvUniversal utility function for cross-platform environment variable access
• Good: Conditional feature activation via environment variable is appropriate for debugging functionality
• Good: Uses spread operator for clean conditional object property inclusion

⚠️ Security Concerns

• High Priority: Potential information disclosure risk - Logging all headers could expose sensitive information:
  • Authentication tokens (Authorization, Cookie headers)
  • API keys passed via custom headers
  • User session data
  • Internal routing information
• Recommendation: Consider filtering out sensitive headers or add explicit warnings in documentation

🔍 Potential Issues

• Memory/Performance: JSON.stringify(c.req.header()) on every request when enabled could impact performance in high-traffic scenarios
• Log Volume: This will significantly increase log verbosity when enabled
• Missing Documentation: No documentation about the _RIVET_LOG_HEADERS feature in code comments

💡 Suggestions for Improvement

1. Security Enhancement - Consider filtering sensitive headers:

const SENSITIVE_HEADERS = ['authorization', 'cookie', 'x-api-key'];
const safeHeaders = Object.fromEntries(
  Object.entries(c.req.header()).filter(([key]) => 
    !SENSITIVE_HEADERS.includes(key.toLowerCase())
  )
);

2. Add JSDoc Documentation:

// Add comment explaining the feature and security implications
...(getEnvUniversal("_RIVET_LOG_HEADERS")
  ? { allHeaders: JSON.stringify(c.req.header()) } // WARNING: May log sensitive data
  : {}),

3. Performance Consideration: The current implementation is acceptable for debugging, but consider caching or rate limiting if this becomes a permanent feature.

📊 Test Coverage

• Missing: No tests for the new conditional logging behavior
• Recommendation: Add unit tests to verify:
  • Headers are logged when _RIVET_LOG_HEADERS is set
  • Headers are not logged when environment variable is unset
  • JSON serialization doesn't break with unusual header values

🎯 Overall Assessment

This is a straightforward debugging feature that's well-implemented from a code perspective. The main concern is the security implication of potentially logging sensitive headers. Consider the security enhancements suggested above before merging.

Approval Status: ⚠️ Conditional - Address security concerns before merging

pnpm add https://pkg.pr.new/rivet-dev/rivetkit/@rivetkit/actor@1397

pnpm add https://pkg.pr.new/rivet-dev/rivetkit/@rivetkit/cloudflare-workers@1397

pnpm add https://pkg.pr.new/rivet-dev/rivetkit/@rivetkit/core@1397

pnpm add https://pkg.pr.new/rivet-dev/rivetkit/@rivetkit/db@1397

pnpm add https://pkg.pr.new/rivet-dev/rivetkit/@rivetkit/framework-base@1397

pnpm add https://pkg.pr.new/rivet-dev/rivetkit/@rivetkit/next-js@1397

pnpm add https://pkg.pr.new/rivet-dev/rivetkit/@rivetkit/react@1397

pnpm add https://pkg.pr.new/rivet-dev/rivetkit@1397

pnpm add https://pkg.pr.new/rivet-dev/rivetkit/@rivetkit/sql-loader@1397

commit: f9826cd

Merge activity

• Oct 16, 7:43 PM UTC: NathanFlurry added this pull request to the Graphite merge queue.
• Oct 16, 7:44 PM UTC: CI is running for this pull request on a draft pull request (#1403) due to your merge queue CI optimization settings.
• Oct 16, 7:44 PM UTC: Merged by the Graphite merge queue via draft PR: #1403.