Follow-up to the PII-redaction fix, addressing the compliance-swarm findings on this unauthenticated client telemetry sink:
- Per-/24 rate limit (30/min) via checkRateLimit — bounds log-flooding (CC6.1). Fails open when no limiter is configured; the whole handler is wrapped so a transient limiter error degrades to { ok:false } rather than a 500.
- Cap message length (2000) and serialized extra size (8 KB) — bounds client input (V2.2). Shape is coerced rather than strictly schema-rejected, so a malformed report still logs (this endpoint exists to capture client errors).
- No auth added: the endpoint is intentionally called pre-auth during onboarding.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The onboarding client-error endpoint logged untrusted client-supplied message + extra via raw console.error + JSON.stringify(extra) with NO redaction, leaking personnummer / IBAN / tokens into Vercel logs. Route through the structured logger (createLogger), whose REDACT_KEYS + redactString sanitize both the message and the nested extra payload before emit. Response contract unchanged ({ ok: true|false }).
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Jakob Wennberg