rg -n --hidden -g "!node_modules" -g "!dist" -g "!.output" "console\\.(log|info|warn|error)|logger\\.(debug|info|warn|error)|print\\(|System\\.out|log\\." .

rg -n --hidden -g "!node_modules" -g "!dist" -g "!.output" "(req|request|headers|body|payload|user|order|payment|prompt|messages|token|cookie|authorization)" .

logger.info({ headers: req.headers, body: req.body }, "request failed");
logger.error({ error, user, order }, "create order failed");
console.log("llm prompt", systemPrompt, userPrompt);

logger.warn(
  {
    requestId,
    route: req.route?.path,
    method: req.method,
    statusCode: 400,
    userIdHash: hashUserId(user.id),
    orderId: order.id,
    errorCode: "ORDER_PRICE_CHANGED"
  },
  "create order rejected"
);

const safeHeaders = {
  "user-agent": req.headers["user-agent"],
  "content-type": req.headers["content-type"],
  "x-request-id": req.headers["x-request-id"],
  "x-forwarded-for": maskIp(req.headers["x-forwarded-for"])
};

logger.info({ requestId, headers: safeHeaders }, "request metadata");

logger.info(
  {
    requestId,
    authType: "bearer",
    tokenFingerprint: fingerprintToken(req.headers.authorization)
  },
  "auth checked"
);

export function maskPhone(value: string) {
  return value.replace(/^(\d{3})\d{4}(\d{4})$/, "$1****$2");
}

export function maskEmail(value: string) {
  const [name, domain] = value.split("@");
  if (!name || !domain) return "***";
  return `${name.slice(0, 2)}***@${domain}`;
}

logger.info(
  {
    requestId,
    userIdHash: hashUserId(user.id),
    phone: maskPhone(user.phone),
    email: maskEmail(user.email)
  },
  "profile update requested"
);

logger.warn(
  {
    requestId,
    orderId,
    userIdHash,
    amount,
    currency,
    status: "PAYMENT_FAILED",
    paymentProvider: "stripe",
    providerCode: "card_declined"
  },
  "payment failed"
);

logger.warn({ order, paymentCallback, user }, "payment failed");

logger.debug({ systemPrompt, userPrompt, messages }, "llm request");

logger.info(
  {
    requestId,
    model,
    taskType: "support_summary",
    inputTokens,
    outputTokens,
    promptTemplateVersion,
    sensitiveClass: "customer_support",
    toolCallCount
  },
  "llm request completed"
);

function toSafeError(error: unknown) {
  if (!(error instanceof Error)) {
    return { name: "UnknownError", message: "Unknown error" };
  }

  return {
    name: error.name,
    message: error.message,
    stack: error.stack?.split("\n").slice(0, 8).join("\n")
  };
}

logger.error(
  {
    requestId,
    error: toSafeError(error)
  },
  "third party request failed"
);

const redactPaths = [
  "req.headers.authorization",
  "req.headers.cookie",
  "headers.authorization",
  "headers.cookie",
  "body.password",
  "body.token",
  "body.refresh_token",
  "body.api_key",
  "user.phone",
  "user.email",
  "payment.card",
  "messages",
  "prompt",
  "systemPrompt"
];

- [ ] No full Authorization, Cookie, Set-Cookie, API key, refresh token in logs
- [ ] No full phone, email, ID number, address, payment account in logs
- [ ] No full request body or response body in normal logs
- [ ] No full order object, payment callback payload, shipping address in logs
- [ ] No full AI prompt, system prompt, messages, uploaded file text in logs
- [ ] Logger redaction is configured globally
- [ ] Error objects are converted to safe fields before logging
- [ ] Debug logging is disabled or tightly scoped in production
- [ ] Production log access is limited and audited
- [ ] Log retention matches data sensitivity
- [ ] CI and deployment logs do not print secrets or environment variables
- [ ] Security events still keep requestId, actor, action, target and result

rg -n --hidden -g "!node_modules" -g "!dist" -g "!.output" "(Authorization|Set-Cookie|refresh_token|api_key|secret|password|private_key|DATABASE_URL)" .

rg -n --hidden -g "!node_modules" -g "!dist" -g "!.output" "(systemPrompt|userPrompt|messages|prompt|paymentCallback|request\\.body|req\\.body|req\\.headers)" .