Add automatic sensitive data redaction to response formatters

[Copilot]

Overview

Security audit found no code leaks. Added defense-in-depth by implementing automatic redaction of sensitive fields in all response formatters to prevent accidental exposure through logging or error messages.

Changes

Sensitive Data Redaction

• Modified: etherscan-common.js, etherscan_common.py, query-validator-rewards.js, query-validator-rewards.py
• Redacts fields matching: apikey, token, password, secret, authorization, etc.
• Recursive processing of nested objects and arrays
• Case-insensitive field matching

Example:

const response = { 
  status: "1", 
  apikey: "ZITG8EMXRFSWU2CDTNT4XEI7GDYB2JBMGD",
  data: { token: "secret-value", result: "success" }
};

console.log(formatResponse(response));
// Output: {"status":"1","apikey":"[REDACTED]","data":{"token":"[REDACTED]","result":"success"}}

Test Coverage

• Added 3 test cases in etherscan-common.test.js verifying redaction of single, multiple, and nested sensitive fields
• All 128 tests pass

Documentation

• New: SECURITY_AUDIT_REPORT.md - Complete audit findings
• New: SECURITY_IMPROVEMENTS.md - Implementation details and rationale
• Updated: README.md - Links to security documentation

Verification

• CodeQL: 0 vulnerabilities
• No breaking changes - fully backward compatible

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Yaketh (Kushmanmb)]

hide keys