From dfd87dd2944a93b5e5278d26399aaac7bf6c184f Mon Sep 17 00:00:00 2001 From: Jakob Wennberg <149234542+jakobwennberg@users.noreply.github.com> Date: Wed, 3 Jun 2026 17:18:46 +0200 Subject: [PATCH] fix(security): redact PII in /api/log before it reaches Vercel logs (audit E1) (#649) The onboarding client-error endpoint logged untrusted client-supplied message + extra via raw console.error + JSON.stringify(extra) with NO redaction, leaking personnummer / IBAN / tokens into Vercel logs. Route through the structured logger (createLogger), whose REDACT_KEYS + redactString sanitize both the message and the nested extra payload before emit. Response contract unchanged ({ ok: true|false }). Co-authored-by: Claude Opus 4.8 (1M context) --- app/api/log/route.ts | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/app/api/log/route.ts b/app/api/log/route.ts index 59cfc950..ce7c029e 100644 --- a/app/api/log/route.ts +++ b/app/api/log/route.ts @@ -1,11 +1,18 @@ import { NextResponse } from 'next/server' +import { createLogger } from '@/lib/logger' + +const log = createLogger('onboarding-client') export async function POST(request: Request) { try { const { message, extra } = await request.json() - // This console.error runs server-side → visible in Vercel Logs - console.error('[onboarding]', message, extra ? JSON.stringify(extra) : '') + // Client-reported onboarding errors. Route through the structured logger so + // the (untrusted, client-supplied) message + extra are PII-redacted — + // personnummer / IBAN / tokens etc. via the logger's REDACT_KEYS — before + // reaching Vercel logs. The previous raw `console.error(..., JSON.stringify(extra))` + // logged them verbatim. + log.error('client onboarding error', { clientMessage: message, extra }) return NextResponse.json({ ok: true }) } catch {