My own scrubber was bypassed by the very next line — leak survived 13 releases

Thirumalaiboobathi · reddit · 2026-08-31

A first-party security retro of opentel-mcp v0.13.0

Root cause: computeFingerprint(err) strips emails/IPs/URLs/paths, but the very next lines — span.recordException(err) and span.setStatus — put the unscrubbed original on the span. Standard OTel's recordException records exception.message and stacktrace verbatim, no filtering.
The stacktrace is quieter still: absolute filesystem paths leak usernames and directory structure, skipping even the cwd-stripping the fingerprint path had. The bug survived 13 releases with tests green.
Second issue: mcp.tool.model was read from the tool's own response (including JSON parsed from content[0].text) with only a typeof check — tool-controlled text on a span used as a metric label, with unbounded cardinality.

Fixes

New errorRecording.mode (full | normalized | none), defaulting to full — recordException has defined OTel semantics, silently changing it would break debugging invisibly.
Model IDs are now allowlisted and length-capped; rejection sets pricingstatus = "unknown" and warns on shape only, never the value.

Check your own code: does recordException sit outside your attribute governance? If you scrub before hashing, does the raw original get emitted elsewhere in the same function?

Original post →

My own scrubber was bypassed by the very next line — leak survived 13 releases

More from coding & agent