mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Sanitize Discord error logs to prevent secret exposure #188

New Issue
Closed
opened 2026-02-02 17:24:36 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-02-02 17:24:36 +00:00
Owner
Copy Link

Problem

Discord client errors are logged without sanitization, potentially exposing the bot token in error stack traces.

Location

apps/api/src/bridge/discord/discord.service.ts:82

this.client.on(Events.Error, (error) => {
  this.logger.error("Discord client error:", error);
  // ❌ Error might contain authentication token
});

Exposure Risks

  1. Bot token in connection string errors
  2. Channel IDs in error messages
  3. User data in error context
  4. System paths in stack traces
  5. Configuration details

Impact

  • Bot token compromise → full Discord server takeover
  • Channel IDs exposed → unauthorized access
  • Privacy violation from logged user messages
  • System information disclosure

Acceptance Criteria

  • Create sanitizeDiscordError() utility
  • Redact tokens with regex pattern matching
  • Remove sensitive channel/guild IDs
  • Strip full stack traces from logs
  • Alert admins on critical Discord errors
  • Add tests for sanitization
  • Document sensitive data patterns

Implementation

this.client.on(Events.Error, (error) => {
  const sanitizedError = this.sanitizeDiscordError(error);
  this.logger.error("Discord client error:", sanitizedError);
  
  if (this.isCriticalDiscordError(error)) {
    this.notifyAdmins("Discord integration failure");
  }
});

private sanitizeDiscordError(error: Error): object {
  return {
    message: error.message.replace(
      /[\w-]{24}\.[\w-]{6}\.[\w-]{27}/g, 
      '[REDACTED_TOKEN]'
    ),
    name: error.name,
    // Omit stack and sensitive properties
  };
}

Testing

  • Test bot token redaction
  • Test channel ID removal
  • Verify critical errors trigger alerts
  • Check logs don't contain sensitive data

References

M4.2-Infrastructure verification report (2026-02-02)
Security review agent ID: a1b8b3f

## Problem Discord client errors are logged without sanitization, potentially exposing the bot token in error stack traces. ## Location apps/api/src/bridge/discord/discord.service.ts:82 ```typescript this.client.on(Events.Error, (error) => { this.logger.error("Discord client error:", error); // ❌ Error might contain authentication token }); ``` ## Exposure Risks 1. Bot token in connection string errors 2. Channel IDs in error messages 3. User data in error context 4. System paths in stack traces 5. Configuration details ## Impact - Bot token compromise → full Discord server takeover - Channel IDs exposed → unauthorized access - Privacy violation from logged user messages - System information disclosure ## Acceptance Criteria - [ ] Create sanitizeDiscordError() utility - [ ] Redact tokens with regex pattern matching - [ ] Remove sensitive channel/guild IDs - [ ] Strip full stack traces from logs - [ ] Alert admins on critical Discord errors - [ ] Add tests for sanitization - [ ] Document sensitive data patterns ## Implementation ```typescript this.client.on(Events.Error, (error) => { const sanitizedError = this.sanitizeDiscordError(error); this.logger.error("Discord client error:", sanitizedError); if (this.isCriticalDiscordError(error)) { this.notifyAdmins("Discord integration failure"); } }); private sanitizeDiscordError(error: Error): object { return { message: error.message.replace( /[\w-]{24}\.[\w-]{6}\.[\w-]{27}/g, '[REDACTED_TOKEN]' ), name: error.name, // Omit stack and sensitive properties }; } ``` ## Testing - [ ] Test bot token redaction - [ ] Test channel ID removal - [ ] Verify critical errors trigger alerts - [ ] Check logs don't contain sensitive data ## References M4.2-Infrastructure verification report (2026-02-02) Security review agent ID: a1b8b3f
jason.woltje added this to the M4.2-Infrastructure (0.0.4) milestone 2026-02-02 17:24:36 +00:00
jason.woltje added the securityapiapip1 labels 2026-02-02 17:24:36 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ai
AI/LLM integration
 api
Backend/API work
 api
auth
Authentication
 database
database
Database/schema work
 devops
Docker/deployment
 docs
Documentation
 frontend
graph
knowledge-module
migration
Data migration
 orchestrator
Orchestrator service (apps/orchestrator/)
 p0
Critical priority
 p1
High priority
 p2
Medium priority
 p3
Low priority
 performance
Performance work
 phase-1
phase-2
phase-3
phase-4
phase-5
plugin
MoltBot plugin work
 search
security
Security-related
 setup
Initial setup
 testing
Testing/QA
 web
Frontend work
No Label api api p1 security
Milestone
No items
No Milestone M4.2-Infrastructure (0.0.4)
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaic/stack#188
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?