Why this matters now: The audit log is meant to be safe to retain; currently it can store raw user-entered PII (proof notes, bios) and nested objects unredacted.
Problem / What: redactDetails (audit.ts:56-68) only inspects top-level body keys against a whitelist. notes (proof.review / validator.review) and bio are whitelisted and stored verbatim; nested objects/arrays are not traversed for PII. The audit details column thus contains free-text PII.
Key Challenges: Defining a PII-safe redaction policy that also handles nested structures and known-sensitive fields, while preserving the operational value of the log.
Acceptance Criteria:
- No raw free-text user input (notes, bio) is stored unredacted in
AuditLog.details; nested PII is handled.
- A test feeds PII-laden bodies and asserts redaction in the stored row.
Relevant files/functions: src/middleware/audit.ts:17-68, src/services/auditService.ts:60-77.
Out of scope: Encrypting the audit table at rest.
Labels: advanced, security, bug
Why this matters now: The audit log is meant to be safe to retain; currently it can store raw user-entered PII (proof notes, bios) and nested objects unredacted.
Problem / What:
redactDetails(audit.ts:56-68) only inspects top-level body keys against a whitelist.notes(proof.review / validator.review) andbioare whitelisted and stored verbatim; nested objects/arrays are not traversed for PII. The auditdetailscolumn thus contains free-text PII.Key Challenges: Defining a PII-safe redaction policy that also handles nested structures and known-sensitive fields, while preserving the operational value of the log.
Acceptance Criteria:
AuditLog.details; nested PII is handled.Relevant files/functions:
src/middleware/audit.ts:17-68,src/services/auditService.ts:60-77.Out of scope: Encrypting the audit table at rest.
Labels: advanced, security, bug