Skip to content

fix(redaction): consolidate redaction utils, apply them to inputs and outputs before persisting logs #2478

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
waleedlatif1 merged 2 commits into from
Dec 19, 2025
Merged

fix(redaction): consolidate redaction utils, apply them to inputs and outputs before persisting logs #2478

waleedlatif1 merged 2 commits into from
Dec 19, 2025

Conversation

@waleedlatif1
Copy link
Collaborator

@waleedlatif1 waleedlatif1 commented Dec 19, 2025

Summary

  • consolidate redaction utils, apply them to inputs and outputs before persisting logs

Type of Change

  • New feature

Testing

Tested manually

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

@vercel
Copy link

vercel bot commented Dec 19, 2025 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Review Updated (UTC)
docs Skipped Skipped Dec 19, 2025 9:03pm

@greptile-apps
Copy link
Contributor

greptile-apps bot commented Dec 19, 2025 •
edited
Loading

Greptile Summary

  • Consolidates scattered redaction utilities across the codebase into a centralized redaction.ts module with comprehensive pattern matching for sensitive data like API keys, passwords, and tokens
  • Updates terminal console store and instrumentation client to apply redaction to both input and output fields before persisting data to ensure consistent security practices
  • Replaces hardcoded redaction markers with a standardized REDACTED_MARKER constant and moves existing redaction tests to the new dedicated test file

Important Files Changed

Filename Overview
apps/sim/lib/core/security/redaction.ts New centralized redaction module with pattern-based sensitive key detection; contains overly broad regex patterns that may cause false positives
apps/sim/stores/terminal/console/store.ts Updated to apply redaction to both inputs and outputs before persisting console entries; inherits pattern matching issues from new redaction module
apps/sim/instrumentation-client.ts Replaced inline sanitization function with centralized redaction utility; may over-redact telemetry data due to pattern matching issues

Confidence score: 2/5

  • This PR requires careful review due to critical pattern matching issues that will cause over-redaction and false positives in production
  • Score lowered due to overly broad regex patterns in SENSITIVE_KEY_PATTERNS (like /^.*token$/i, /^.*secret$/i) that will match legitimate keys such as tokenCount, hasSecret, userAuthenticated, etc.
  • Pay close attention to apps/sim/lib/core/security/redaction.ts - the pattern matching logic needs refinement to avoid breaking legitimate functionality

Sequence Diagram

sequenceDiagram
    participant User
    participant StagehandAPI as "Stagehand API"
    participant ValidationService as "Validation Service"
    participant RedactionService as "Redaction Service"
    participant Stagehand
    participant Browser as "Browserbase"

    User->>StagehandAPI: "POST /api/tools/stagehand/agent"
    StagehandAPI->>ValidationService: "validate request schema"
    ValidationService-->>StagehandAPI: "validation result"
    StagehandAPI->>RedactionService: "sanitize variables for logging"
    RedactionService-->>StagehandAPI: "sanitized variables"
    StagehandAPI->>Stagehand: "initialize with Browserbase"
    Stagehand-->>StagehandAPI: "initialized instance"
    StagehandAPI->>Browser: "navigate to startUrl"
    Browser-->>StagehandAPI: "page loaded"
    StagehandAPI->>Stagehand: "create agent with instructions"
    Stagehand-->>StagehandAPI: "agent instance"
    StagehandAPI->>Stagehand: "execute task with variables"
    Stagehand-->>StagehandAPI: "agent execution result"
    StagehandAPI->>StagehandAPI: "parse structured output from result"
    StagehandAPI->>Stagehand: "close instance"
    StagehandAPI-->>User: "return agent result and structured output"
Loading

greptile-apps[bot]
greptile-apps bot reviewed Dec 19, 2025
View reviewed changes
Copy link
Contributor

@greptile-apps greptile-apps bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

8 files reviewed, 3 comments

Edit Code Review Agent Settings | Greptile

@waleedlatif1
Copy link
Collaborator Author

waleedlatif1 commented Dec 19, 2025

@greptile

greptile-apps[bot]
greptile-apps bot reviewed Dec 19, 2025
View reviewed changes
Copy link
Contributor

@greptile-apps greptile-apps bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

9 files reviewed, 3 comments

Edit Code Review Agent Settings | Greptile

@waleedlatif1 waleedlatif1 merged commit 65efa03 into staging Dec 19, 2025
11 checks passed
@waleedlatif1 waleedlatif1 deleted the fix/terminal branch December 19, 2025 21:17
@waleedlatif1 waleedlatif1 mentioned this pull request Dec 20, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@waleedlatif1