sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(security): redact-on-rotate for error.log archive + README PII docs (DC-108) [glm-grade=B]
CI / Test & Lint (push) Canceled after 0s
Details
CI / Security audit (push) Canceled after 0s
Details

Browse Source 
DC-095 masks emails at every live log sink; the rotated archive was the
remaining belt-and-braces gap — any future sink that forgets masking would
persist raw PII in error.log.1 for a full rotation cycle. appendErrorLog
now scrubs the freshly rotated archive with the SAME canonical mask
(sa****@example.com) via atomic rewrite (sibling .redact-<pid> temp, wx
open preserving mode else 0600, fsync, rename). Scrub failure is caught
and logged; the new error line is still appended. Stale crash-leftover
.redact-<pid> temps are swept best-effort on every rotation. Also
documents scripts/redact-log-pii.js usage in README (queue item e).

Judge: GLM-5.3 cold read (deleg_e7cd7f8c), round-1 grade B ship — both
nits addressed in-commit: stale-temp sweep (new 5th test pins it),
quoted-local-part mask edge deferred as pre-existing DC-095 primitive.

Tests: 122 suites / 2790 green (+5 DC-108 pins; was 2785 post-DC-107).
This commit is contained in:
Hermes
2026-08-23 05:22:04 -07:00
parent 5efacd11e8
commit c429b8fdd7
3 changed files with 228 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+13
View File
@@ -214,6 +214,19 @@ For secure remote access:
3. Refresh to see latest errors
4. Clear logs when resolved
### Log PII Redaction
Every log sink (console JSON, `error.log`, audit details) masks email addresses with a canonical form (`sa****@example.com`) — raw addresses never reach disk or stdout. When `error.log` crosses 5 MB it rotates to `error.log.1`, and the archive is scrubbed with the same canonical mask on rotation.
For **pre-existing** log files written before this defense existed:
```bash
node scripts/redact-log-pii.js --dry-run <file-or-dir> # see what would change
node scripts/redact-log-pii.js <file-or-dir> # atomic in-place rewrite
```
The script is idempotent, never touches byte-identical files (mtime preserved), reuses the same masking code the live logger uses (no regex drift), and post-verifies that no raw address remains (exit code 2 if any does). See `dashcaddy-api/scripts/redact-log-pii.js` header for flags including `--keep-raw` (explicitly preserves the raw copy — avoid unless required).
### Backup & Restore
**Export Configuration:**