fix(logging): stop leaking env values and secrets in messages, make context serialization non-throwing

src/observability/tracing/service-tracer.test.ts

@@ -607,6 +607,92 @@ describe("observability/tracing/service-tracer", () => {
     });
   });
 
+  it("serializes object attributes without inherited toJSON hooks", () => {
+    const originalObjectToJSON = Object.getOwnPropertyDescriptor(Object.prototype, "toJSON");
+    const originalArrayToJSON = Object.getOwnPropertyDescriptor(Array.prototype, "toJSON");
+    Object.defineProperty(Object.prototype, "toJSON", {
+      configurable: true,
+      value() {
+        throw new Error("polluted object serializer");
+      },
+    });
+    Object.defineProperty(Array.prototype, "toJSON", {
+      configurable: true,
+      value() {
+        throw new Error("polluted array serializer");
+      },
+    });
+
+    try {
+      const harness = createHarness();
+      const serviceTracer = createOpenTelemetryServiceTracer({
+        serviceName: "test-service",
+        context: harness.contextApi,
+        trace: harness.traceApi,
+        errorStatusCode: 2,
+      });
+      const span = serviceTracer.tracer.startSpan("manual-operation");
+
+      span.setTag("metadata", {
+        apiKey: "secret",
+        nested: [{ ok: true }],
+      });
+
+      assertEquals(
+        harness.startedSpans[0]?.attributes.metadata,
+        '{"apiKey":"[REDACTED]","nested":[{"ok":true}]}',
+      );
+    } finally {
+      if (originalObjectToJSON) {
+        Object.defineProperty(Object.prototype, "toJSON", originalObjectToJSON);
+      } else {
+        delete (Object.prototype as { toJSON?: unknown }).toJSON;
+      }
+      if (originalArrayToJSON) {
+        Object.defineProperty(Array.prototype, "toJSON", originalArrayToJSON);
+      } else {
+        delete (Array.prototype as { toJSON?: unknown }).toJSON;
+      }
+    }
+  });
+
+  it("ignores hooks added through the intrinsic array prototype chain", () => {
+    const originalArrayPrototypeParent = Object.getPrototypeOf(Array.prototype);
+    let hookCalls = 0;
+    const hostileParent = Object.create(originalArrayPrototypeParent) as {
+      toJSON?: () => unknown;
+    };
+    hostileParent.toJSON = () => {
+      hookCalls += 1;
+      return "polluted-array";
+    };
+
+    Object.setPrototypeOf(Array.prototype, hostileParent);
+    try {
+      const harness = createHarness();
+      const serviceTracer = createOpenTelemetryServiceTracer({
+        serviceName: "test-service",
+        context: harness.contextApi,
+        trace: harness.traceApi,
+        errorStatusCode: 2,
+      });
+      const span = serviceTracer.tracer.startSpan("manual-operation");
+
+      span.setTag("metadata", {
+        apiKey: "secret",
+        nested: [{ ok: true }],
+      });
+
+      assertEquals(hookCalls, 0);
+      assertEquals(
+        harness.startedSpans[0]?.attributes.metadata,
+        '{"apiKey":"[REDACTED]","nested":[{"ok":true}]}',
+      );
+    } finally {
+      Object.setPrototypeOf(Array.prototype, originalArrayPrototypeParent);
+    }
+  });
+
   it("isolates manual span attribute and finish failures", () => {
     const harness = createHarness();
     const serviceTracer = createOpenTelemetryServiceTracer({

src/observability/tracing/service-tracer.ts

@@ -1,4 +1,4 @@
-import { REDACTED, redactForSerialization } from "#veryfront/utils/logger/redact.ts";
+import { stringifyRedactedAttributeValue } from "#veryfront/utils/logger/serialization.ts";
 import { MAX_SPAN_NAME_LENGTH } from "#veryfront/utils/constants/index.ts";
 import {
   MAX_OBSERVABILITY_NAME_LENGTH,
@@ -158,13 +158,7 @@ function toAttributeValue(
   }
 
   if (typeof value === "object") {
-    try {
-      const redacted = redactForSerialization(value);
-      if (typeof redacted === "string") return redacted;
-      return JSON.stringify(redacted) ?? REDACTED;
-    } catch (_) {
-      return REDACTED;
-    }
+    return stringifyRedactedAttributeValue(value);
   }
 
   return value;

src/utils/env-loader.test.ts

@@ -252,5 +252,67 @@ describe("env-loader", () => {
         __resetLoggerConfigForTests();
       }
     });
+
+    it("should not print environment values in debug logs", async () => {
+      const key = createKey("SECRET_LOG");
+      const secret = "highly-sensitive-value";
+      const previousLogLevel = getEnv("LOG_LEVEL");
+      const previousLogFormat = getEnv("LOG_FORMAT");
+      const originalDebug = console.debug;
+      const output: string[] = [];
+
+      try {
+        setEnv("LOG_LEVEL", "DEBUG");
+        setEnv("LOG_FORMAT", "json");
+        __resetLoggerConfigForTests();
+        console.debug = (message: string) => output.push(message);
+        await writeEnvFile(".env", `${key}=${secret}`);
+
+        await loadEnv({ cwd: tempDir, override: true, debug: true });
+
+        assertEquals(output.join("\n").includes("highly-sensitive"), false);
+        assertEquals(output.join("\n").includes(key), true);
+      } finally {
+        console.debug = originalDebug;
+        cleanupKeys(key);
+        if (previousLogLevel === undefined) deleteEnv("LOG_LEVEL");
+        else setEnv("LOG_LEVEL", previousLogLevel);
+        if (previousLogFormat === undefined) deleteEnv("LOG_FORMAT");
+        else setEnv("LOG_FORMAT", previousLogFormat);
+        __resetLoggerConfigForTests();
+      }
+    });
+
+    it("should strip credentials from the logged VERYFRONT_API_BASE_URL", async () => {
+      const previousValue = getEnv("VERYFRONT_API_BASE_URL");
+      const previousLogFormat = getEnv("LOG_FORMAT");
+      const { getOutput, restore } = captureConsoleLog();
+
+      try {
+        setEnv("LOG_FORMAT", "json");
+        __resetLoggerConfigForTests();
+        await writeEnvFile(
+          ".env",
+          "VERYFRONT_API_BASE_URL=https://user:hybrid-basic-secret@api.example.com/api",
+        );
+
+        await loadEnv({ cwd: tempDir, override: true });
+
+        const output = getOutput();
+        const entry = JSON.parse(output) as LogEntry;
+        assertEquals(
+          entry.message,
+          "VERYFRONT_API_BASE_URL loaded: https://user:[REDACTED]@api.example.com/api",
+        );
+        assertEquals(output.includes("hybrid-basic-secret"), false);
+      } finally {
+        restore();
+        if (previousValue === undefined) deleteEnv("VERYFRONT_API_BASE_URL");
+        else setEnv("VERYFRONT_API_BASE_URL", previousValue);
+        if (previousLogFormat === undefined) deleteEnv("LOG_FORMAT");
+        else setEnv("LOG_FORMAT", previousLogFormat);
+        __resetLoggerConfigForTests();
+      }
+    });
   });
 });

src/utils/env-loader.ts

@@ -1,4 +1,5 @@
 import { refreshLoggerConfig, serverLogger } from "./logger/index.ts";
+import { sanitizeUrlCredentials } from "./logger/redact.ts";
 import { cwd as getCwd, getEnv, setEnv } from "#veryfront/platform/compat/process.ts";
 import { isNotFoundError, readTextFile } from "#veryfront/platform/compat/fs.ts";
 
@@ -37,13 +38,15 @@ export async function loadEnv(
         envSources.set(key, file);
         totalVars++;
 
+        // Log only the key name and value length — never any part of the value.
+        // Env files routinely carry credentials (VERYFRONT_API_TOKEN, DSNs), and
+        // a 20-char prefix is enough to leak most of a token.
         if (debug) {
-          logger.debug(
-            `[env] ${key}=${value.substring(0, 20)}${value.length > 20 ? "..." : ""}`,
-          );
+          logger.debug(`[env] ${key} (${value.length} chars)`);
         }
         if (key === "VERYFRONT_API_BASE_URL") {
-          logger.info(`VERYFRONT_API_BASE_URL loaded: ${value}`);
+          // Hybrid setups can embed userinfo credentials in the URL; strip them.
+          logger.info(`VERYFRONT_API_BASE_URL loaded: ${sanitizeUrlCredentials(value)}`);
         }
       }
 

src/utils/logger/logger-hostile-fallback.fixture.ts

@@ -0,0 +1,45 @@
+const originalObjectValues = Object.values;
+const originalObjectToJSON = Object.getOwnPropertyDescriptor(Object.prototype, "toJSON");
+let output = "";
+
+try {
+  Object.values = () => {
+    throw new Error("polluted Object.values");
+  };
+  Object.defineProperty(Object.prototype, "toJSON", {
+    configurable: true,
+    value() {
+      throw new Error("inherited serializer must not run");
+    },
+  });
+
+  // Initialize the serializer while the intrinsic is hostile so the logger's
+  // degraded fallback path is exercised after the global is restored.
+  await import("./serialization.ts");
+  Object.values = originalObjectValues;
+
+  Deno.env.set("LOG_FORMAT", "json");
+  const { __resetLoggerConfigForTests, getBaseLogger } = await import("./logger.ts");
+  __resetLoggerConfigForTests();
+
+  const originalConsoleLog = console.log;
+  try {
+    console.log = (value: unknown) => {
+      output = String(value);
+    };
+    getBaseLogger("SERVER")
+      .component("token=synthetic-component-secret")
+      .info("Fallback probe", { ok: true });
+  } finally {
+    console.log = originalConsoleLog;
+  }
+} finally {
+  Object.values = originalObjectValues;
+  if (originalObjectToJSON !== undefined) {
+    Object.defineProperty(Object.prototype, "toJSON", originalObjectToJSON);
+  } else {
+    delete (Object.prototype as { toJSON?: unknown }).toJSON;
+  }
+}
+
+console.log(output);