Review brief

An administration API is centralizing audit logging for successful and failed actions. Callers may attach nested JSON-like metadata assembled from request bodies and headers, and the audit sink must remain available when metadata contains cycles introduced by framework objects.

Behavioral contract

At every object depth, including objects inside arrays, keys matching `password`, `token`, `authorization`, `cookie`, `set-cookie`, or `secret` case-insensitively must have the value `[REDACTED]`.
Matching is by the complete key, not a substring: fields such as `tokenCount` and `secretaryName` remain visible. Non-sensitive JSON-compatible values retain their structure.
Redaction and serialization must not mutate metadata or nested values supplied by the caller.
An `Error` contributes only its safe `name` and an optional application `code` that callers have already allowlisted; its message, stack, cause, and custom fields are not written because they may contain request data.
Metadata may contain repeated or circular object references. Audit emission must not throw; cycles are represented as `[Circular]` while non-cyclic branches remain available.
Actor ID, action, target ID, and route template are approved top-level audit fields. The sink accepts one JSON line and transport reliability is outside this change.

Review instructions

1Review the redaction policy across case variants, nesting, arrays, errors, and circular references.
2Separate privacy findings from mutation and audit-availability consequences.
3Prioritize no more than five findings and avoid requesting redaction of explicitly permitted fields.

Learning objectives

• Apply a redaction policy throughout nested data
• Preserve caller-owned values while sanitizing output
• Keep audit emission safe for errors and cyclic metadata

src/audit-types.tsTypeScript

@@ -0,0 +1,16 @@

1+export interface AuditEvent {

2+ actorId: string;

3+ action: string;

4+ targetId: string;

5+ routeTemplate: string;

6+ metadata: Record<string, unknown>;

7+ error?: unknown;

8+}

10+export interface AuditSink {

11+ write(line: string): Promise<void>;

12+}

13+

14+export interface ApplicationError extends Error {

15+ code?: string;

16+}

Reference solution

The findings below are ordered by priority.

Findings

1. Common sensitive keys and case variants are emitted

Location: src/audit-redaction.ts:1-8

The list omits cookie, set-cookie, and secret, and comparison is case-sensitive. Values under keys such as Authorization, PASSWORD, or Cookie therefore pass directly into the audit line even though the contract classifies them as credentials.

Canonicalize each complete key for comparison and use the full policy set. Preserve exact-key matching so permitted names such as tokenCount are not over-redacted.

2. Redaction stops at the first object level

Location: src/audit-redaction.ts:3-12

Only entries directly on metadata are inspected. Credentials inside nested request objects or objects stored in arrays remain unchanged and are serialized by the writer.

Walk arrays and plain objects recursively, applying the same complete-key policy at every object depth while preserving non-sensitive structure.

3. Error messages and stacks can disclose request data

Location: src/audit-writer.ts:26-37

errorDetails explicitly adds message and stack. Validation messages, downstream URLs, and stack-attached context commonly include user input or credentials, so a failed administrative action can leak data even if metadata redaction were complete.

Emit only the safe error name and an allowlisted application code. Exclude message, stack, cause, and arbitrary custom properties.

4. Sanitizing an event changes caller-owned metadata

Location: src/audit-redaction.ts:3-12 and src/audit-writer.ts:11-12

redactMetadata replaces fields on the original object and returns that same reference. Code that reuses the metadata after audit emission sees redaction placeholders instead of its original values, while nested mutation would make the problem broader once recursion is added.

Build a sanitized copy during traversal. Use reference tracking to preserve repeated references safely without assigning into caller-owned objects or arrays.

5. Circular metadata prevents the audit event from being written

Location: src/audit-writer.ts:14-23

The payload retains nested object references and is passed directly to JSON.stringify. A framework object that points back to itself makes serialization throw, dropping the audit record and potentially replacing the operation's actual outcome with a logging failure.

Track objects by identity during the non-mutating traversal and replace only back-edges with [Circular] before serialization. Keep other branches intact and still let genuine sink transport failures follow the existing contract.

Reasonable non-findings

Approved actor and target identifiers are intentionally present at the top level; they make the audit record attributable.
Complete-key matching should not redact tokenCount or secretaryName merely because they contain sensitive words.
Awaiting the sink is acceptable because the scenario explicitly excludes transport reliability and latency policy.