fix(axiom): remove sensitive data from error logs and cleanup #192

fkesheh · 2026-01-28T15:17:41Z

Remove user prompts/messages from error logs in extractErrorDetails
Remove WebVitals tracking from client
Remove middleware request logging

Summary by CodeRabbit

Bug Fixes
- Enhanced security by filtering sensitive user information from error logs.
Removed Features
- Web performance metrics tracking (web vitals) has been removed.
Chores
- Streamlined server-side request logging to reduce redundant log output.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

- Remove user prompts/messages from error logs in extractErrorDetails - Remove WebVitals tracking from client - Remove middleware request logging

vercel · 2026-01-28T15:17:46Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
hackerai	Ready	Preview, Comment	Jan 28, 2026 3:28pm

coderabbitai · 2026-01-28T15:18:13Z

📝 Walkthrough

Walkthrough

This change removes WebVitals telemetry from the layout and Axiom client, removes middleware request logging, and adds recursive sanitization to error extraction to strip sensitive fields from logged data.

Changes

Cohort / File(s)	Summary
WebVitals Telemetry Removal `app/layout.tsx`, `lib/axiom/client.ts`	Removes `WebVitals` import and rendering from the root layout; deletes creation/export of the `WebVitals` component in Axiom client and simplifies `useLogger` export to a direct invocation.
Middleware Logging Removal `middleware.ts`	Removes `logger` and `transformMiddlewareRequest` imports and the request logging + flush logic; renames unused `event` parameter to `_event`.
Error Data Sanitization `lib/utils/error-utils.ts`	Adds `SENSITIVE_KEYS` and `removeSensitiveData` (recursive, circular-safe) and applies sanitization to `responseBody` and provider data in `extractErrorDetails` to prevent sensitive fields from being logged.

Sequence Diagram(s)

(omitted — changes are removals and a local sanitization utility; no multi-component new control flow requiring a sequence diagram)

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

fix(auth): handle non-browser auth redirects and add auto-retry #137: Modifies middleware.ts signature/implementation and relates to middleware request handling changes.

Poem

🐰 I hopped through code at break of day,

snipped the Vitals gently away.
I tuck secrets deep, out of sight,
so logs stay kind and sleep at night. ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(axiom): remove sensitive data from error logs and cleanup' accurately summarizes the main changes: removing sensitive data from error logs and removing unused logging/tracking components.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@lib/utils/error-utils.ts`:
- Around line 34-57: The removeSensitiveData function can infinite-recurse on
circular structures; update it to accept and use a WeakSet (e.g., visited) to
track seen objects, returning a safe placeholder (or the original non-traversed
value) when an object is already in visited; mark objects as visited when first
traversed, pass the same WeakSet into recursive calls for both arrays and nested
objects, and ensure primitive short-circuits remain unchanged; reference the
removeSensitiveData function and SENSITIVE_KEYS so you add the WeakSet logic
around Object/Array traversal and recursive calls.

lib/utils/error-utils.ts

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@lib/utils/error-utils.ts`:
- Around line 98-105: The current flow uses removeSensitiveData on
anyError.responseBody and anyError.data but removeSensitiveData returns strings
unchanged, so sensitive text can be logged; update the implementation of
removeSensitiveData (and/or add a helper like sanitizeString) to handle
primitive string inputs by applying a defensive redaction policy (e.g., mask API
keys, PII patterns, and long prompt-like content or replace with a fixed
redacted placeholder) before returning, then keep using removeSensitiveData
where details.responseBody and details.providerData are assigned; alternatively,
if you cannot safely redact here, add a clear code comment/documentation on
removeSensitiveData stating that responseBody and data are guaranteed safe and
must not contain sensitive content.

coderabbitai · 2026-01-28T15:30:08Z

lib/utils/error-utils.ts

+    details.responseBody = removeSensitiveData(anyError.responseBody);
  }
  if ("isRetryable" in anyError) {
    details.isRetryable = anyError.isRetryable;
  }
  if ("data" in anyError) {
-    details.providerData = anyError.data;
+    details.providerData = removeSensitiveData(anyError.data);
  }


⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

# First, let's find the removeSensitiveData function and understand what it does rg -n "removeSensitiveData" lib/utils/error-utils.ts -A 10 -B 2

Repository: hackerai-tech/hackerai

Length of output: 1088

🏁 Script executed:

# Also search for the function definition rg -n "function removeSensitiveData|const removeSensitiveData|export.*removeSensitiveData" -A 15

Repository: hackerai-tech/hackerai

Length of output: 1009

🏁 Script executed:

# Let's look at the entire error-utils.ts file to understand context wc -l lib/utils/error-utils.ts

Repository: hackerai-tech/hackerai

Length of output: 94

🏁 Script executed:

# Search for type definitions of error objects with responseBody or data fields rg -n "responseBody|providerData" -B 5 -A 2 --type=ts

Repository: hackerai-tech/hackerai

Length of output: 2269

🏁 Script executed:

# Read the full removeSensitiveData function to see all logic sed -n '35,70p' lib/utils/error-utils.ts

Repository: hackerai-tech/hackerai

Length of output: 951

🏁 Script executed:

# Search for data field type definitions in error objects rg -n "data\s*\?*:\s*(string|unknown|any)" -B 3 -A 1 --type=ts

Repository: hackerai-tech/hackerai

Length of output: 5132

🏁 Script executed:

# Look for error object type definitions more broadly rg -n "interface.*Error|type.*Error" --type=ts -A 8 | head -100

Repository: hackerai-tech/hackerai

Length of output: 4454

🏁 Script executed:

# Check what SENSITIVE_KEYS contains rg -n "SENSITIVE_KEYS" lib/utils/error-utils.ts -B 5 -A 5

Repository: hackerai-tech/hackerai

Length of output: 595

🏁 Script executed:

# Look for how responseBody and data are populated to understand if they could contain sensitive info rg -n "\.responseBody\s*=" -B 3 -A 1 --type=ts

Repository: hackerai-tech/hackerai

Length of output: 764

🏁 Script executed:

# Check how the error details are used/logged after extraction rg -n "getErrorDetails|extractErrorDetails|providerData|responseBody" lib/ -A 2 --type=ts | head -60

Repository: hackerai-tech/hackerai

Length of output: 1646

removeSensitiveData passes strings unchanged—confirm responseBody and data won't contain sensitive content.

The function returns primitive values (including strings) as-is without inspection (line 40). Since responseBody is typed as string, any sensitive content embedded in error messages (e.g., prompts, rejection reasons) will be logged verbatim. Similarly, data fields may be strings or contain unfiltered string content. Either document that these fields are guaranteed to be safe, or add a defensive redaction layer for string values.

🤖 Prompt for AI Agents

In `@lib/utils/error-utils.ts` around lines 98 - 105, The current flow uses removeSensitiveData on anyError.responseBody and anyError.data but removeSensitiveData returns strings unchanged, so sensitive text can be logged; update the implementation of removeSensitiveData (and/or add a helper like sanitizeString) to handle primitive string inputs by applying a defensive redaction policy (e.g., mask API keys, PII patterns, and long prompt-like content or replace with a fixed redacted placeholder) before returning, then keep using removeSensitiveData where details.responseBody and details.providerData are assigned; alternatively, if you cannot safely redact here, add a clear code comment/documentation on removeSensitiveData stating that responseBody and data are guaranteed safe and must not contain sensitive content.

fix(axiom): remove sensitive data from error logs and cleanup

33b5652

- Remove user prompts/messages from error logs in extractErrorDetails - Remove WebVitals tracking from client - Remove middleware request logging

vercel bot deployed to Preview January 28, 2026 15:18 View deployment

coderabbitai bot reviewed Jan 28, 2026

View reviewed changes

lib/utils/error-utils.ts Show resolved Hide resolved

fix(axiom): guard against circular references in removeSensitiveData

8151a3c

vercel bot deployed to Preview January 28, 2026 15:28 View deployment

coderabbitai bot reviewed Jan 28, 2026

View reviewed changes

rossmanko merged commit 55e98fc into main Jan 28, 2026
4 checks passed

fkesheh deleted the fix/axiom-logging-cleanup branch January 28, 2026 17:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(axiom): remove sensitive data from error logs and cleanup #192

fix(axiom): remove sensitive data from error logs and cleanup #192

Uh oh!

fkesheh commented Jan 28, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

vercel bot commented Jan 28, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Jan 28, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Poem

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

coderabbitai bot left a comment

Uh oh!

coderabbitai bot Jan 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

fix(axiom): remove sensitive data from error logs and cleanup #192

fix(axiom): remove sensitive data from error logs and cleanup #192

Uh oh!

Conversation

fkesheh commented Jan 28, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

vercel bot commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Poem

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

fkesheh commented Jan 28, 2026 •

edited by coderabbitai bot

Loading

vercel bot commented Jan 28, 2026 •

edited

Loading

coderabbitai bot commented Jan 28, 2026 •

edited

Loading