fix(core): don't log full event payloads or deep-link tokens at info level - #1326
Open
sunitaprajapati89 wants to merge 2 commits into
Open
fix(core): don't log full event payloads or deep-link tokens at info level#1326sunitaprajapati89 wants to merge 2 commits into
sunitaprajapati89 wants to merge 2 commits into
Conversation
didiergarcia
requested changes
Sep 8, 2026
didiergarcia
requested changes
Sep 8, 2026
didiergarcia
left a comment
didiergarcia
left a comment
There was a problem hiding this comment.
A few changes to capture edge cases
MichaelGHSeg
approved these changes
Sep 8, 2026
didiergarcia flagged four issues on #1326: - redactDeepLinkUrl only stripped the query string; OAuth callback tokens in the URL fragment (myapp://callback#access_token=...) survived redaction. Split on /[?#]/ instead of '?'. - The deep-link track call logged the pre-process event because `void this.process(event)` discarded its result, so messageId was always undefined. Await the result via .then() (keeping the call site fire-and-forget) and log the processed event. - `processedEvent ?? event` collapsed "saved", "disabled", and "dropped by a before/consent plugin" into one misleading "event saved" log. Added logEventResult() to log "<label> event dropped" when processing yields undefined, reused across screen/track/ identify/group/alias and the deep-link path. - Fixed the debugPayloads JSDoc: it logs the full payload *in addition to* metadata, not instead of it. Added test coverage for fragment redaction and the dropped-event log path. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
sunitaprajapati89
enabled auto-merge (squash)
September 9, 2026 08:45
sunitaprajapati89
disabled auto-merge
September 9, 2026 08:45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Track/screen/identify/group/alias/deep-link event logging previously
passed the entire SegmentEvent (userId, traits, properties, and the raw
deep-link URL) to logger.info. The default Logger only disables itself
when NODE_ENV === 'production', which many RN release bundles don't set
for JS, and any custom logger or logger.enable() call re-exposed this
data to logcat/device logs and log-capture SDKs.
by default.
debugPayloadsconfig flag to opt into full-payloadlogging, gated behind a startup warning about the PII/token exposure.
even when debugPayloads is enabled.
pre-processed one, so the metadata log is actually useful for
correlation.