webdevcody / webdevcody/code-racer

[TASK]: Make sure that no PII data is ever logged. And logging in general for that matter...

Open
#247 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
697
Forks
594
PR merge metrics
No merged PRs in 30d

Description

Task Summary

related to: #246

PII (Personal Identifiable Information) has to be deletable at any point in time. Logging this kind of information out would force us to delete our logs or have complex log sanitation processes, and Logs should be "write only" in the first place anyway.

In general, it is a good idea to remove any and all non critical log statements.

A good log statement has the following properties:

  • Understandable, i.e. it provides enough information to make sense by itself. Example "New game session :id started", counter example (some component logging out some prop on its own) "3"
  • It enables us to understand system behavior. Example "Game :id failed to start - :reason", counter example "It is now :time".
  • It is not noisy. Logging always has to balance verbosity versus noise. It is easy to be tempted to just "log everything", but "logging everything" can be just as bad as "logging nothing", because the sheer amount of data makes it impossible to actually understand the logs

It is understandable that for debugging reasons one might want to add more verbose logs. One option is to put such logs behind feature flags, pipeline enforcement, or proper care during reviews.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files, tests, or entry points are named. Start by auditing the repository's logging statements and identify where PII or non-critical data may be emitted; done means PII is never logged and remaining logs are understandable, behavior-focused, and not noisy.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
observability, security
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.