Class: Findbug::Processing::DataScrubber

Inherits:
Object
  • Object
show all
Defined in:
lib/findbug/processing/data_scrubber.rb

Overview

DataScrubber removes sensitive data from captured events.

WHY SCRUBBING IS CRITICAL

Error data often contains sensitive information:

  • User passwords (in form params)

  • API keys (in headers)

  • Credit card numbers (in payment flows)

  • Personal data (in user context)

Even though Findbug is self-hosted, you don’t want this data:

  1. Stored in your database

  2. Visible in the dashboard

  3. In logs or backups

  4. Accessible to developers who shouldn’t see it

SCRUBBING STRATEGY

We replace sensitive values with “[FILTERED]” rather than removing them. This way you can see that the field existed (helpful for debugging) without exposing the actual value.

WHAT WE SCRUB

  1. Known field names (password, api_key, etc.)

  2. Credit card patterns (16 digits)

  3. SSN patterns (XXX-XX-XXXX)

  4. Sensitive headers (Authorization, Cookie)

  5. Custom fields from configuration

Constant Summary collapse

FILTERED = 
"[FILTERED]"
CREDIT_CARD_PATTERN =

Credit card patterns (Visa, MasterCard, Amex, etc.)

/\b(?:\d{4}[-\s]?){3}\d{4}\b/
SSN_PATTERN =

SSN pattern

/\b\d{3}[-\s]?\d{2}[-\s]?\d{4}\b/
BEARER_TOKEN_PATTERN =

Bearer token in text

/Bearer\s+[A-Za-z0-9\-_.~+\/]+=*/i
API_KEY_PATTERN =

API key-like patterns (long alphanumeric strings)

/\b[A-Za-z0-9]{32,}\b/

Class Method Summary collapse

Class Method Details

.scrub(event) ⇒ Hash

Scrub an entire event hash

Parameters:

  • event (Hash) —

    the event data to scrub

Returns:

  • (Hash) —

    scrubbed event data



59
60
61
 
# File 'lib/findbug/processing/data_scrubber.rb', line 59

def scrub(event)
  deep_scrub(event)
end

.scrub_string(value) ⇒ String

Scrub a string value for patterns

Parameters:

  • value (String) —

    the string to scrub

Returns:

  • (String) —

    scrubbed string



68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
 
# File 'lib/findbug/processing/data_scrubber.rb', line 68

def scrub_string(value)
  return value unless value.is_a?(String)

  value = value.dup

  # Scrub credit card numbers
  value.gsub!(CREDIT_CARD_PATTERN, FILTERED)

  # Scrub SSN
  value.gsub!(SSN_PATTERN, FILTERED)

  # Scrub Bearer tokens
  value.gsub!(BEARER_TOKEN_PATTERN, "Bearer #{FILTERED}")

  # Scrub potential API keys (but not in backtraces)
  # Only scrub in certain contexts to avoid false positives
  # value.gsub!(API_KEY_PATTERN, FILTERED)

  value
end