[Feat][SDK-601] Add built in scrubbing#377
Open
buongarzoni wants to merge 9 commits into
Open
Claude / Claude Code Review
completed
Jul 13, 2026 in 12m 43s
Code review found 1 important issue
Found 5 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 1 |
| 🟡 Nit | 0 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | rollbar-java/src/main/java/com/rollbar/notifier/scrubbing/ScrubDataTransformer.java:121-149 |
Scrubbing gaps: Request.params, Request.metadata, and rollbarThreads Frame.locals bypass redactedKeys |
Annotations
claude / Claude Code Review
Scrubbing gaps: Request.params, Request.metadata, and rollbarThreads Frame.locals bypass redactedKeys
The built-in scrubber has three coverage gaps where user-populated data flows around `redactedKeys`:
1. **`Request.params`** — routing parameters (e.g. `/reset/:token`) are copied through `new Request.Builder(req)` and serialized under `"params"` but `scrubRequest` never touches them.
2. **`Request.metadata`** — flattened directly into the outgoing JSON via `values.putAll(metadata)` (Request.java:141-143), structurally identical to `custom` which *is* scrubbed.
3. **`Frame.locals` in `body.rollb
Loading