Sensitive data

// BAD: full URL with sensitive query parameters
span.setAttribute('http.url', 'https://example.com/callback?token=eyJhbG...&email=user@example.com');

// GOOD: strip query parameters entirely
function sanitizeUrl(url) {
  const parsed = new URL(url);
  parsed.search = '';
  return parsed.toString();
}
span.setAttribute('url.full', sanitizeUrl(req.url));

// GOOD: redact specific sensitive parameters, keep the rest
function redactSensitiveParams(url, sensitiveKeys) {
  const parsed = new URL(url);
  for (const key of sensitiveKeys) {
    if (parsed.searchParams.has(key)) {
      parsed.searchParams.set(key, 'REDACTED');
    }
  }
  return parsed.toString();
}
span.setAttribute('url.full', redactSensitiveParams(req.url, ['token', 'api_key', 'session']));

// BAD: literal values in the query attribute
span.setAttribute('db.query.text', "SELECT * FROM users WHERE email = 'alice@example.com'");

// GOOD: parameterized query — no literal values
span.setAttribute('db.query.text', 'SELECT * FROM users WHERE email = $1');

// SpanProcessor that sanitizes db.query.text by replacing literal values with '?'
class DbQuerySanitizingSpanProcessor {
  onStart() {}

  onEnd(span) {
    const query = span.attributes['db.query.text'];
    if (typeof query === 'string') {
      span.attributes['db.query.text'] = query
        .replace(/'[^']*'/g, '?')       // single-quoted strings
        .replace(/"[^"]*"/g, '?')       // double-quoted strings
        .replace(/\b\d+(\.\d+)?\b/g, '?'); // numeric literals
    }
  }

  shutdown() { return Promise.resolve(); }
  forceFlush() { return Promise.resolve(); }
}

import { createHmac } from 'node:crypto';

function hashForTelemetry(value, key) {
  return createHmac('sha256', key).update(value).digest('hex');
}

// Use the hash as the attribute value
span.setAttribute('user.id', hashForTelemetry(user.email, process.env.TELEMETRY_HASH_KEY));

// BAD: spreads the entire request body — may contain passwords, tokens, PII
logger.info('user.signup', { ...req.body, ...getTraceContext() });

// GOOD: explicitly select safe fields
logger.info('user.signup', {
  ...getTraceContext(),
  user_id: req.body.userId,
  plan: req.body.plan,
});

const SENSITIVE_PATTERNS = [
  { pattern: /\b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b/g, replacement: '****-****-****-****' },  // credit card numbers
  { pattern: /\b\d{3}-\d{2}-\d{4}\b/g,                     replacement: '***-**-****' },           // SSNs
  { pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, replacement: '[EMAIL]' },     // email addresses
  { pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, replacement: '[JWT]' },      // JWT tokens
  { pattern: /\b(sk_|pk_|key_|token_)[a-zA-Z0-9_-]{20,}/g,  replacement: '[API_KEY]' },            // API key prefixes
];

function redactMessage(message) {
  let result = message;
  for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
    result = result.replace(pattern, replacement);
  }
  return result;
}

// Usage in structured logging
logger.info(redactMessage(`Payment processed for ${userEmail}`), {
  ...getTraceContext(),
  payment_method: 'credit_card',
});

import { SpanProcessor } from '@opentelemetry/sdk-trace-base';

const SENSITIVE_ATTRIBUTES = [
  'http.request.header.authorization',
  'http.request.header.cookie',
  'http.response.header.set-cookie',
];

class SensitiveDataRedactingSpanProcessor {
  onStart(_span, _parentContext) {}

  onEnd(span) {
    for (const attr of SENSITIVE_ATTRIBUTES) {
      if (span.attributes[attr] !== undefined) {
        span.attributes[attr] = 'REDACTED';
      }
    }

    // Strip query parameters from url.full
    if (typeof span.attributes['url.full'] === 'string') {
      try {
        const parsed = new URL(span.attributes['url.full']);
        parsed.search = '';
        span.attributes['url.full'] = parsed.toString();
      } catch {
        // Not a valid URL — leave as-is
      }
    }
  }

  shutdown() { return Promise.resolve(); }
  forceFlush() { return Promise.resolve(); }
}

import { NodeTracerProvider } from '@opentelemetry/sdk-trace-node';
import { BatchSpanProcessor } from '@opentelemetry/sdk-trace-base';
import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-grpc';

const provider = new NodeTracerProvider();
provider.addSpanProcessor(new SensitiveDataRedactingSpanProcessor());
provider.addSpanProcessor(new BatchSpanProcessor(new OTLPTraceExporter()));
provider.register();

function assertSensitiveHeadersRedacted() {
  const SENSITIVE_HEADERS = [
    'http.request.header.authorization',
    'http.request.header.cookie',
    'http.response.header.set-cookie',
  ];

  for (const span of getSpans()) {
    for (const header of SENSITIVE_HEADERS) {
      const value = span.attributes[header];
      if (value !== undefined && value !== 'REDACTED') {
        throw new Error(
          `Span "${span.name}" contains unredacted header "${header}"`,
        );
      }
    }
  }
}

function assertUserIdIsHashed() {
  const PII_PATTERNS = [
    /^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$/, // email
    /\s/,                                                   // contains spaces (likely a display name)
  ];

  for (const span of getSpans()) {
    const userId = span.attributes['user.id'];
    if (typeof userId === 'string') {
      for (const pattern of PII_PATTERNS) {
        if (pattern.test(userId)) {
          throw new Error(
            `Span "${span.name}" has user.id matching PII pattern: "${userId}"`,
          );
        }
      }
    }
  }
}

// BAD: logs everything, including auth headers and body
logger.info('request.received', { headers: req.headers, body: req.body });

// GOOD: log only what you need
logger.info('request.received', {
  ...getTraceContext(),
  method: req.method,
  path: req.path,
  content_length: req.headers['content-length'],
});

// BAD: PII as an attribute value
span.setAttribute('user.id', 'alice@example.com');

// GOOD: opaque identifier
span.setAttribute('user.id', 'usr_a1b2c3d4');

// BAD: user-supplied input echoed into telemetry
span.setStatus({
  code: SpanStatusCode.ERROR,
  message: `Validation failed: ${req.body.email} is not a valid email`,
});

// GOOD: describe the error without echoing user input
span.setStatus({
  code: SpanStatusCode.ERROR,
  message: 'ValidationError: invalid email format',
});