Jakob Wennberg dfd87dd294 fix(security): redact PII in /api/log before it reaches Vercel logs (audit E1) (#649) ...

The onboarding client-error endpoint logged untrusted client-supplied message + extra via raw console.error + JSON.stringify(extra) with NO redaction, leaking personnummer / IBAN / tokens into Vercel logs. Route through the structured logger (createLogger), whose REDACT_KEYS + redactString sanitize both the message and the nested extra payload before emit. Response contract unchanged ({ ok: true|false }).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-03 17:18:46 +02:00

..

route.ts

fix(security): redact PII in /api/log before it reaches Vercel logs (audit E1) (#649)

2026-06-03 17:18:46 +02:00