Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Filter youth/volunteer PII from logs and Bugsnag (notes, case_number, DOB, phone…)

Abierto
  • ¿Algo no está bien?
#7,263 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 18 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
52/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
rails, ruby
Área
backend, security

Línea de trabajo

Start with config/initializers/filter_parameter_logging.rb and config/initializers/bugsnag.rb, then inspect the existing parameter filtering specs and SECURITY.md. Add filtering coverage for the listed keys, review how set_user and Bugsnag request URLs are handled, and document the vendor data policy. Done means the requested sensitive values are filtered or redacted, the behavior is covered by specs, and the policy is documented.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

⛓️ Security Difficulty: Intermediate Help Wanted

Problem

CASA data is about foster youth, so anything we send to third parties (Bugsnag, Scout APM, Heroku/log drains) should be the minimum needed to debug.

config/initializers/filter_parameter_logging.rb filters only passw, email, secret, token, _key, crypt, salt, certificate, otp, ssn, cvv, cvc. These are permitted request params that aren't filtered, so they appear in Rails logs and in the request metadata Bugsnag attaches to errors:

Param Where Why it matters
notes, content case contacts, notes, court orders free-text narrative about a youth
case_number casa cases, imports juvenile court case number
birth_month_year_youth, date_of_birth casa cases, users DOB
display_name, phone_number, address users, volunteers volunteer PII

Also:

  • config/initializers/bugsnag.rb calls event.set_user(current_user&.id, current_user&.email). The user id is enough to look someone up. Consider sending only the id.
  • Case URLs contain the case-number slug (/casa_cases/cina-21-1234), so it ends up in router logs and Bugsnag App URL. That will matter more once #7106 lands org + case number in the path. Look at Bugsnag's redacted_keys / an add_on_error callback that rewrites request.url, and Heroku log drains.

Tasks

  • Add :notes, :content, :case_number, :birth, :phone, :address, :display_name, :first_name, :last_name to filter_parameters (it's substring-matched, so check nothing we need in logs gets swallowed)
  • Add a spec asserting those keys are filtered (ActiveSupport::ParameterFilter.new(Rails.application.config.filter_parameters).filter(...))
  • Decide on set_user email vs id only
  • Bugsnag callback that redacts case slugs from event.request[:url] / context
  • Note the policy in SECURITY.md: what we send to which vendor

Related: safe read-only observability access (see linked issue).

Lenguaje dominante
Ruby
Estrellas
382
Forks
547
Merge medio
10 d 19 h
PR fusionados (30 d)
20

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de rubyforgood/casa

Todos los issues de rubyforgood/casa

Issues similares

Más issues de Ruby

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.