Redacting Sensitive Data from Events

The safest sensitive value is one that never enters the event pipeline. Build structured events from an explicit allowlist instead of serializing a request, exception, model response, or database object and attempting to remove dangerous keys afterward.

Data to exclude by default

Do not log API keys, passwords, session cookies, authorization headers, webhook signatures, payment details, full request bodies, database connection strings, or raw prompts and completions. Free-form text can contain personal or confidential data even when its field name appears harmless.

Prefer internal opaque identifiers to email addresses. Replace raw exceptions with a controlled error_type and keep the full stack trace in a diagnostic system with appropriate access and retention. Replace URLs containing identifiers or query strings with stable route templates.

Apply controls at the boundary

Create the event object field by field:

const event = {
  route_template: request.routeOptions.url,
  method: request.method,
  status_code: response.statusCode,
  latency_ms: elapsedMs,
  account_id: account.internalId,
};

await telemetry.log("api_request_completed", event);

When a reusable sanitizer is necessary, treat it as defense in depth. Test nested objects, arrays, alternate capitalization, and unexpected types. Bound string lengths and reject fields outside the contract. Hashing is not anonymization when the original value has a small or guessable set.

Review and respond

Assign an owner to every high-volume event contract. Review sample rows in development before enabling production emission. Revisit retention and access needs when a new identifier is added.

If sensitive data is discovered, stop the emitting path, identify affected tables and time ranges, rotate any exposed secret, and use the supported deletion workflow where appropriate. Then add a regression test that exercises the actual event constructor.

Read designing an event schema for contract practices and the Log API reference for the ingestion shape.