From 05c069e4f89c4e38b1faaf2f5c7197b2474e18b0 Mon Sep 17 00:00:00 2001 From: minibits-cash Date: Tue, 9 Jun 2026 15:30:43 +0200 Subject: [PATCH] chore(logging): redact secrets in keyChain trace logs Truncate or omit sensitive values in trace-level logs: Nostr private key, base64 seed and auth token now log only an 8-char prefix, and saveWalletKeys logs walletId instead of the full key material. Co-Authored-By: Claude Opus 4.8 --- src/services/keyChain.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/services/keyChain.ts b/src/services/keyChain.ts index c2b03f31..8b3e1e2b 100644 --- a/src/services/keyChain.ts +++ b/src/services/keyChain.ts @@ -64,7 +64,7 @@ const generateNostrKeyPair = function () { const privateKey = bytesToHex(privateKeyBytes) const publicKey = getPublicKey(privateKeyBytes) - log.trace('New random Nostr keypair created', {publicKey, privateKey}) + log.trace('New random Nostr keypair created', {publicKey, privateKey: privateKey.slice(0, 8) + '...'}) return {publicKey, privateKey} as NostrKeyPair } catch (e: any) { @@ -138,7 +138,7 @@ const generateWalletKeys = function (accountIndex: number = DEFAULT_NOSTR_ACCOUN const seedBytesArray = bip39.mnemonicToSeedSync(mnemonic) const seed = Buffer.from(seedBytesArray).toString('base64') - log.trace('[generateWalletKeys] Seed generated from mnemonic (base64)', {seed}) + log.trace('[generateWalletKeys] Seed generated from mnemonic (base64)', {seed: seed.slice(0, 8) + '...'}) const seedHash = QuickCrypto .createHash('sha256') @@ -197,7 +197,7 @@ const saveWalletKeys = async function ( }, ) - log.trace('[saveWalletKeys]', 'Saved wallet keys to the KeyChain', {walletKeys}) + log.trace('[saveWalletKeys]', 'Saved wallet keys to the KeyChain', {walletId: walletKeys.walletId}) return result } catch (e: any) { @@ -284,7 +284,7 @@ const generateAuthToken = (): string => { const uint8Array = new Uint8Array(tokenBytes) const tokenBase64 = btoa(String.fromCharCode(...uint8Array)) - log.trace('New Base64 authToken created:', tokenBase64) + log.trace('New Base64 authToken created:', tokenBase64.slice(0, 8) + '...') return tokenBase64 } catch (e: any) {