Dev Shares Critical Privacy Leak in Scrubber: Raw Data Emitted After Sanitization
selfhostcusimbored · reddit · 2026-08-31
A developer discovered a critical privacy flaw while using OpenTelemetry's recordException. Although the code computed a fingerprint and sanitized sensitive info (emails, IPs) in the first line, subsequent recordException and setStatus calls emitted the raw error message directly to the backend, bypassing the sanitizer. The bug persisted for 13 releases. The fix involves adding an errorRecording.mode config (defaulting to full to respect OTel semantics) and enforcing allowlists and length caps on tool-controlled text labels. The author advises checking if raw data is emitted elsewhere in the same function after sanitization.
Related event: Dev Reveals Sanitizer Bypass Bug Leaking Sensitive Data for 13 Releases(2 posts)→
More from coding & agent
- Short vs long context windows for coding agents — mrdrozdov · 2026-08-31
- Agent Optimization Prompt: Design Systems for Agent Ergonomics — doodlestein · 2026-08-31
- NCCL+MIG Support Arrives: Emulate Multi-Node 3D Parallelism on a Single GPU — StasBekman · 2026-08-31
- AgentsView: A Local Audit Dashboard for Coding Agent Costs & Usage — aigclink · 2026-08-31
- Don't code your own bot; let AI design one based on your context — XFreeze · 2026-08-31
- Testing Qwen3.8-27B on Groq: Fast but Lacks Time Awareness — coslinedev · 2026-08-31