Skip to content

Conversation

nickdichev
Copy link

@nickdichev nickdichev commented Jul 31, 2025

Hey guys,

I'm using better-auth in my app which uses fetch under the hood to make requests. I noticed that sensitive credentials were leaking into HyperDX via the fetch instrumentation. Obviously, I don't want this to happen.

This PR attempts to add a redaction mechanism on the fetch instrumentation. Was looking for some initial feedback on what you all think about this direction, since I think some of the other auto-instrumentation could/should use a similar pattern. I think there's a couple of other ways this feature could be implemented like modifying the HyperDXSpanProcessor or writing a custom exporter, but that would add a JSON.parse on every span (on http.request.body), which is maybe undesirable?

This work allows the application developer to instantiate their client side hyperdx like this:

HyperDX.init({
  apiKey: import.meta.env.PUBLIC_ENV__HYPERDX_API_KEY,
  service: import.meta.env.PUBLIC_ENV__HYPERDX_SERVICE_NAME || "unknown",
  tracePropagationTargets: [],
  consoleCapture: true,
  advancedNetworkCapture: true,
  instrumentations: {
    fetch: {
      propogateTraceHeaderCorsUrls: [],
      advancedNetworkCapture: () => true,
      redactKeys: {
        body: ["password"],
        headers: ["date", /content_.*/],
      },
    },
  },
});

Which will then end up like this on the console:

Screenshot 2025-07-29 at 8 10 31 PM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant