Jakob Wennberg dfd87dd294 fix(security): redact PII in /api/log before it reaches Vercel logs (audit E1) (#649) ...

The onboarding client-error endpoint logged untrusted client-supplied message + extra via raw console.error + JSON.stringify(extra) with NO redaction, leaking personnummer / IBAN / tokens into Vercel logs. Route through the structured logger (createLogger), whose REDACT_KEYS + redactString sanitize both the message and the nested extra payload before emit. Response contract unchanged ({ ok: true|false }).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-03 17:18:46 +02:00

..

account

Fix/chrome pdf preview csp (#572)

2026-05-26 22:29:41 +02:00

agent

feat(sandbox,branding): prod-parity demo with AI gating + accounted rebrand (#585)

2026-05-28 13:19:41 +02:00

assets

Fix/chrome pdf preview csp (#572)

2026-05-26 22:29:41 +02:00

audit-trail

test: add real-Postgres smoke gate (pg-real) (#357)

2026-04-24 11:24:45 +02:00

bookkeeping

Enforce MFA on critical mutation routes + post-audit foundation (A1) (#646)

2026-06-03 15:34:58 +02:00

calendar/feed

Delete features (#218)

2026-04-11 17:06:32 +02:00

cash-accounts

feat: implement skattekonto drift detection and alerting (#525)

2026-05-19 16:10:18 +02:00

company

Accounted rebrand + swarm-skill cleanup + bank-reconciliation fixes (#643)

2026-06-03 10:52:01 +02:00

currency/rate

feat(sandbox,branding): prod-parity demo with AI gating + accounted rebrand (#585)

2026-05-28 13:19:41 +02:00

customers

feat: add language preference for customers to support invoice locali… (#561)

2026-05-22 15:21:05 +02:00

deadlines

Logs/improved logging (#398)

2026-05-06 11:12:02 +02:00

documents

Agent v1 bundle: TIC v2 onboarding, in-app assistant gating, sidebar nav, MCP fixes (#584)

2026-05-28 11:27:01 +02:00

events

Logs/improved logging (#398)

2026-05-06 11:12:02 +02:00

extensions

feat: implement skattekonto drift detection and alerting (#525)

2026-05-19 16:10:18 +02:00

health

feat(api): implement caching and logging in health check endpoint (#526)

2026-05-19 17:52:11 +02:00

idempotency/cleanup/cron

Logs/improved logging (#398)

2026-05-06 11:12:02 +02:00

import

feat: voucher linking, recovery ops, and salary overrides (#591)

2026-05-28 21:09:43 +02:00

invoices

Accounted rebrand + swarm-skill cleanup + bank-reconciliation fixes (#643)

2026-06-03 10:52:01 +02:00

kpi/preferences

Delete features (#218)

2026-04-11 17:06:32 +02:00

log

fix(security): redact PII in /api/log before it reaches Vercel logs (audit E1) (#649)

2026-06-03 17:18:46 +02:00

mcp-oauth

feat: enhance OAuth scopes and UI for agent-driven approval process (#544)

2026-05-20 13:39:02 +02:00

pending-operations

Agent v1 bundle: TIC v2 onboarding, in-app assistant gating, sidebar nav, MCP fixes (#584)

2026-05-28 11:27:01 +02:00

reconciliation/bank

Accounted rebrand + swarm-skill cleanup + bank-reconciliation fixes (#643)

2026-06-03 10:52:01 +02:00

reports

Bug/customer invoice bug (#628)

2026-06-02 13:25:48 +02:00

salary

Enforce MFA on critical mutation routes + post-audit foundation (A1) (#646)

2026-06-03 15:34:58 +02:00

sandbox

Enforce MFA on critical mutation routes + post-audit foundation (A1) (#646)

2026-06-03 15:34:58 +02:00

settings

Mcp/template data feedback (#617)

2026-06-01 14:45:49 +02:00

skatteverket/tax-payments/[period]

Add/skv salary agi (#423)

2026-05-09 12:41:16 +02:00

supplier-invoices

Accounted rebrand + swarm-skill cleanup + bank-reconciliation fixes (#643)

2026-06-03 10:52:01 +02:00

suppliers

Add/csv import options (#420)

2026-05-08 15:42:06 +02:00

support/contact

Add/white label (#381)

2026-04-29 16:32:26 +02:00

tax-deadlines

Logs/improved logging (#398)

2026-05-06 11:12:02 +02:00

team

Improve invite flow by replacing user listing with email existence check (#229)

2026-04-13 16:15:20 +02:00

transactions

Reject overpayment on all invoice-match paths (audit C3) (#647)

2026-06-03 17:00:22 +02:00

user/locale

feat: add user locale preference to user_preferences table (#555)

2026-05-21 21:33:22 +02:00

v1

Reject overpayment on all invoice-match paths (audit C3) (#647)

2026-06-03 17:00:22 +02:00

vat/validate

feat(sandbox,branding): prod-parity demo with AI gating + accounted rebrand (#585)

2026-05-28 13:19:41 +02:00

webhooks/dispatch/cron

feat(api): Phase 6 PR-1 — webhooks substrate (delivery pipeline + routes) (#496)

2026-05-15 14:00:04 +02:00