Description
Current logging uses ad-hoc logger.error() calls with inconsistent formats. Sensitive fields like signatures and API keys may be logged in plaintext.
Proposed Solution
Configure pino-http with a custom serializer that redacts signature, secret, x-api-key, and authorization fields. Log request method, path, status code, and duration for every request.
Acceptance Criteria
Suggested Implementation Areas
server.js, src/logger.js
Impact
Enables production log analysis while preventing accidental exposure of secrets in log aggregators.
Description
Current logging uses ad-hoc
logger.error()calls with inconsistent formats. Sensitive fields like signatures and API keys may be logged in plaintext.Proposed Solution
Configure
pino-httpwith a custom serializer that redactssignature,secret,x-api-key, andauthorizationfields. Log request method, path, status code, and duration for every request.Acceptance Criteria
Suggested Implementation Areas
server.js,src/logger.jsImpact
Enables production log analysis while preventing accidental exposure of secrets in log aggregators.