fix(core,webapp): redact sensitive fields in logs by default and cap their size

[carderne]

Summary

Structured logs now redact common credential and sensitive-data fields by
default, including nested values and error metadata. Long strings and arrays
are capped so a single log entry cannot grow without bound.

The same redaction applies to error-reporting extras. Unchanged values retain
their existing references, avoiding unnecessary cloning on ordinary log calls.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 86a9584

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The logging system now applies default and caller-provided key filtering, secret-pattern detection, string and array truncation, and recursion limits. Structured errors use the same redaction pipeline for messages, stacks, metadata, and nested errors. The webapp’s Sentry error-reporting path redacts flattened log arguments before sending exception or message payloads. Tests cover logger output, the standalone redact helper, structured errors, and Sentry payloads.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description only includes a summary and omits required template sections like Closes #issue, checklist, testing, changelog, and screenshots.	Add the missing template sections, including Closes #issue, checklist items, testing steps, changelog, and screenshots if applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: default redaction and log size limits in core/webapp logging.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/logger-redaction-sec-410

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@86a9584

trigger.dev

npm i https://pkg.pr.new/trigger.dev@86a9584

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@86a9584

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@86a9584

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@86a9584

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@86a9584

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@86a9584

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@86a9584

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@86a9584

commit: 86a9584

[ericallam]

This PR has a lot of changes and just want to make sure that we haven't introduced any ELU regressions here, anything with filtering or detecting the length and stuff has the chance of doing that. Lets make sure the filtering and stuff only happens if we are going to log (e.g. if its a debug log, and the logLevel is set to info, none of this work happens

[devin-ai-integration]

Devin Review found 1 new potential issue.

[carderne]

@ericallam did a bunch of microbenchmarks when I reviewed this a few days ago. Briefly:

• Regular Logger, small object: saves ~2.6 µs/log
• SimpleStructuredLogger, small object: costs ~1.5 µs/log

Still net win if we disable debug logging.