feat: Obfuscate potential PII in logs by jaissica12 · Pull Request #1219 · mParticle/mparticle-web-sdk

jaissica12 · 2026-03-20T13:41:12Z

Background

The Logger currently outputs raw batch and event payloads at various log levels (error, warning, verbose). These payloads can include Personally Identifiable Information (PII)—data that can identify or be reasonably linked to an individual, such as email addresses, phone numbers, names, user IDs, IP addresses, or other user-level identifiers.

What Has Changed

Adds obfuscateData method to be used when logging payloads
Updates logger calls to to use obfuscateData method when passing in payloads that may contain PII
Updates identity calls to target matched_identities payload for obfuscation, while allowing the rest of the identity payload to be visible for debugging
Removes Logger from Vault to avoid spamming verbose logs

Screenshots/Video

{Include any screenshots or video demonstrating the new feature or fix, if applicable}

Checklist

I have performed a self-review of my own code.
I have made corresponding changes to the documentation.
I have added tests that prove my fix is effective or that my feature works.
I have tested this locally.

Additional Notes

{Any additional information or context relevant to this PR}

Reference Issue (For employees only. Ignore if you are an outside contributor)

Closes https://go/j/SDKE-889

Note

Medium Risk
Changes logging behavior for event/batch/identity payloads and adds new storage error handling paths; while intended to be safe, it touches batching/upload and identity flows where regressions could impact observability or offline persistence.

Overview
Reduces the chance of leaking PII via logs by introducing utils.obfuscateData/obfuscateDevData and using them when verbose-logging event payloads, batch uploads, Rokt placement attributes/queued payloads, and (in production mode) matched_identities in Identity API responses.

Hardens persistence writes by removing Vault-internal logging, simplifying Vault constructors (no injected logger), and wrapping non-critical store() calls (events/batches offline queues, identity cache, foreground time tracker) in try/catch so storage failures don’t break SDK execution; also updates tests accordingly and documents the new PII logging guideline in AGENTS.md.

^{Written by Cursor Bugbot for commit 642471a. This will update automatically on new commits. Configure here.}

Update vault storage error handling to log instead of throw to prevent breaking SDK flows when storage quota or security errors occur. Update test expectations to match corrected error message.

)

src/batchUploader.ts

alexs-mparticle

vault.ts: Remove the try/catch from store() — let errors propagate to callers.

The vault should be a dumb wrapper around the Storage API. Right now there's a conflict:

vault.ts catches the error internally and logs via console.error
Callers in batchUploader.ts and identity-utils.ts wrap .store() in their own try/catch with Logger.error()

Since the vault swallows the error, the callers' try/catches are dead code — the error never reaches them.

Suggestion: remove the try/catch (and the console.error) from BaseVault.store() entirely. Let the raw setItem error propagate so callers can handle it with proper Logger calls as they're already set up to do.

src/batchUploader.ts

alexs-mparticle

Nit: Inconsistent Logger access in batchUploader.ts

The new error handling code accesses the logger three different ways in the same file:

const { Logger } = this.mpInstance; → Logger.error(...) (in queueEvent)
this.mpInstance.Logger.error(...) (in prepareAndUpload)
logger.error(...) via parameter (in uploadBatches)

They all resolve to the same instance logger, so this is just a style nit — but it'd be cleaner to pick one approach consistently within the new code.

src/batchUploader.ts

AGENTS.md

cursor · 2026-03-20T18:36:34Z

PR Summary

Medium Risk
Changes verbose logging across batch upload, identity, and Rokt flows and removes Vault storage try/catch/logging, which could alter behavior when Storage is unavailable or full. Also expands the SDKLoggerApi contract (isVerbose()), requiring downstream loggers/mocks to implement it.

Overview
Reduces production PII exposure by adding utils.obfuscateData/obfuscateDevData and switching verbose payload logging to emit raw data only in development mode (otherwise logging type-shaped, obfuscated structures).

Applies this to event/batch logging in BatchUploader, developer-supplied attributes/queued message payloads in RoktManager, and selectively obfuscates matched_identities when verbose-logging identity responses.

Simplifies storage vaults by removing injected logger support and all internal verbose/error logging/try-catch in vault.ts, updates Logger/SDKLoggerApi with isVerbose(), and adjusts tests/mocks accordingly.

^{Written by Cursor Bugbot for commit 3b5cf5a. This will update automatically on new commits. Configure here.}

src/batchUploader.ts

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

src/identityApiClient.ts

alexs-mparticle · 2026-03-23T16:38:51Z

src/batchUploader.ts

+            try {
+                this.eventVault.store(this.eventsQueuedForProcessing);
+            } catch (error) {
+                this.mpInstance.Logger.error('Failed to store events to offline storage. Events will remain in memory queue.');


Let's remove this try/catch block and error. it's unnecessary.

Yeah, that makes sense. Removed

alexs-mparticle · 2026-03-23T16:40:39Z

src/batchUploader.ts

+            try {
+                this.eventVault.store([]);
+            } catch (error) {
+                this.mpInstance.Logger.error('Failed to clear events from offline storage.');


I think we can remove these try catches as well

alexs-mparticle · 2026-03-23T16:41:02Z

src/batchUploader.ts

+                // Clear batch queue since everything should be in Offline Storage
+                this.batchesQueuedForProcessing = [];
+            } catch (error) {
+                this.mpInstance.Logger.error('Failed to store batches to offline storage. Batches will remain in memory queue.');


Remove this try/catch

alexs-mparticle · 2026-03-23T16:41:25Z

src/foregroundTimeTracker.ts

+            try {
+                this.timerVault.store(Math.round(this.totalTime));
+            } catch (error) {
+                // Time tracking persistence is not critical for SDK functionality


Remove try/catch block

alexs-mparticle · 2026-03-23T16:41:36Z

src/identity-utils.ts

+    try {
+        idCache.store(cache);
+    } catch (error) {
+        // Silently fail - identity caching is an optimization, not critical for functionality


Remove try/catch

sonarqubecloud · 2026-03-23T21:24:37Z

Quality Gate passed

Issues
6 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
2.4% Duplication on New Code

See analysis details on SonarQube Cloud

alexs-mparticle and others added 7 commits February 26, 2026 15:21

feat: Obfuscate potential PII in logs

a33665b

fix: Address PR Comments

32d666e

fix: Address code review feedback on error handling

5052e07

Update vault storage error handling to log instead of throw to prevent breaking SDK flows when storage quota or security errors occur. Update test expectations to match corrected error message.

feat: obfuscate verbose log payloads when not in development mode (#1168

3b17c8e

)

add Logging and PII Obfuscation in AGENTS.md

c14e1ac

Merge branch 'development' into feat/SDKE-889-logger-obfuscate-data-v2

3a6d630

fix vault changes

12d4648

jaissica12 force-pushed the feat/SDKE-889-logger-obfuscate-data-v2 branch from 6c5f222 to 12d4648 Compare March 20, 2026 14:23

jaissica12 marked this pull request as ready for review March 20, 2026 14:25

jaissica12 requested a review from a team as a code owner March 20, 2026 14:25

cursor bot reviewed Mar 20, 2026

View reviewed changes

src/batchUploader.ts Outdated Show resolved Hide resolved

address cursor bugbot comments

df44a53

alexs-mparticle reviewed Mar 20, 2026

View reviewed changes

cursor bot reviewed Mar 20, 2026

View reviewed changes

src/batchUploader.ts Outdated Show resolved Hide resolved

add error logging in batchUploader

83197c5

alexs-mparticle reviewed Mar 20, 2026

View reviewed changes

src/batchUploader.ts Outdated Show resolved Hide resolved

alexs-mparticle reviewed Mar 20, 2026

View reviewed changes

src/batchUploader.ts Outdated Show resolved Hide resolved

jaissica12 added 2 commits March 20, 2026 12:38

clean up logging in batchUploader

ea55458

fix indentation

642471a

alexs-mparticle reviewed Mar 20, 2026

View reviewed changes

AGENTS.md Outdated Show resolved Hide resolved

update AGENTS.md with PII info

d09a4ea

alexs-mparticle approved these changes Mar 20, 2026

View reviewed changes

cursor bot reviewed Mar 20, 2026

View reviewed changes

src/batchUploader.ts Outdated Show resolved Hide resolved

skip PII obfuscation when verbose logging is disabled

6972337

cursor bot reviewed Mar 23, 2026

View reviewed changes

src/identityApiClient.ts Show resolved Hide resolved

address cursor review

d6775c3

alexs-mparticle requested changes Mar 23, 2026

View reviewed changes

remove unwanted try catch blocks

3b5cf5a

jaissica12 requested a review from alexs-mparticle March 23, 2026 21:24

alexs-mparticle approved these changes Mar 23, 2026

View reviewed changes

Conversation

jaissica12 commented Mar 20, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Background

What Has Changed

Screenshots/Video

Checklist

Additional Notes

Reference Issue (For employees only. Ignore if you are an outside contributor)

Uh oh!

Uh oh!

alexs-mparticle left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

alexs-mparticle left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

alexs-mparticle Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

jaissica12 Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

alexs-mparticle Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

alexs-mparticle Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

alexs-mparticle Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

alexs-mparticle Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Mar 23, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jaissica12 commented Mar 20, 2026 •

edited by cursor bot

Loading

cursor bot commented Mar 20, 2026 •

edited

Loading