Filtering sensitive data

An error report is a snapshot of a moment in your application, and moments in applications contain passwords, tokens and people. Both clients filter before anything is sent, and both let you add to what they filter.

You are the data controller for whatever your application chooses to send. LaraBug processes it on your behalf. The Data Processing Agreement sets out what that means in practice.

What is scrubbed already

Both clients ship a blacklist of field names matched against request parameters and object keys: password, token, secret, auth, cookie and their obvious relatives. A match is replaced, not removed, so you can still see that the field was there.

The JavaScript client also strips a list of query parameters out of URLs, token and access_token and api_key among them, because a URL ends up in a breadcrumb and a breadcrumb ends up in a report.

Adding your own

Laravel, in config/larabug.php:

'blacklist' => [
    'password',
    'password_confirmation',
    'iban',
    'national_insurance_number',
],

JavaScript, at init:

init({
  dsn: import.meta.env.VITE_LARABUG_DSN,
  blacklist: ['iban', 'national_insurance_number'],
  urlBlacklist: ['invite_code'],
})

Both lists are merged with the defaults rather than replacing them, and both match case insensitively on a substring, so iban also covers customer_iban.

The user block

The most personal thing in a report is usually the user, and by default the Laravel client sends the whole model. One method fixes it:

use LaraBug\Concerns\Larabugable;

class User extends Authenticatable implements Larabugable
{
    public function toLarabug(): array
    {
        return ['id' => $this->id];
    }
}

In the browser, pass a user you have chosen rather than one you have to hand.

The last word

The JavaScript client gives you the event itself before it goes:

init({
  dsn: import.meta.env.VITE_LARABUG_DSN,
  beforeSend: (event) => {
    if (event.request?.url?.includes('/admin')) {
      return null
    }

    return event
  },
})

Return null and nothing is sent. Return the event, changed however you like, and that is what arrives.

What you cannot filter

Your own context. Anything you pass to LaraBug::handle($e, 'php', [...]) or captureException(error, {...}) is sent as given: the blacklist covers the fields the client collected, not the ones you added. Put an order id in there, not an address.