Skip to content

chore: wrangler audit remediation #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chitcommit wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore: wrangler audit remediation #12

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion wrangler.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name = "billy-bullshit"
main = "src/index.ts"
compatibility_date = "2024-01-01"
compatibility_date = "2026-03-16"
node_compat = true

# Account and zone settings (update with your Cloudflare account)
Expand Down Expand Up @@ -49,6 +49,9 @@ DEFAULT_MODEL = "@cf/meta/llama-3.1-8b-instruct"
[limits]
cpu_ms = 50000

[[tail_consumers]]
service = "chittytrack"
Comment on lines +52 to +53
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify whether raw error objects are logged and tails are enabled.
rg -n -C3 'console\.error\([^)]*error' --type=ts
rg -n -C2 '^\[\[tail_consumers\]\]|^service\s*=\s*"chittytrack"|^\[observability\]|^enabled\s*=\s*true' --type=toml
rg -n -C3 'ANTHROPIC_API_KEY|OPENAI_API_KEY|Authorization|x-api-key' --type=ts

Repository: chitcommit/billy-bullshit

Length of output: 9031

Tail forwarding exposes raw error objects containing sensitive API metadata.

Raw console.error(..., error) calls across multiple files (src/billy-agent.ts:244, src/index.ts:132/175/223/266/310/363/408, src/conversation-store.ts:28/55/66/78, src/analytics.ts:70) forward unfiltered error objects to the external chittytrack service via [[tail_consumers]]. Since src/billy-agent.ts makes requests to Anthropic and OpenAI using API keys (lines 257, 284), error responses could leak request metadata, headers, or response fragments containing sensitive information.

Sanitize error logging to redact API metadata before console.error is called:

Mitigation: Redact error objects 
- } catch (error) {
-   console.error('AI generation error:', error);
-   return this.getFallbackResponse();
- }
+ } catch (error) {
+   const safeError =
+     error instanceof Error
+       ? { name: error.name, message: error.message }
+       : { message: 'Unknown error' };
+   console.error('AI generation error', safeError);
+   return this.getFallbackResponse();
+ }

Apply same pattern to all other error logging statements.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@wrangler.toml` around lines 52 - 53, Multiple files are forwarding raw Error
objects to the external chittytrack tail_consumer via console.error (notably the
console.error calls in src/billy-agent.ts, src/index.ts,
src/conversation-store.ts, and src/analytics.ts), which can leak API keys or
response metadata; create a single helper (e.g., sanitizeError or redactError)
that accepts any Error/unknown, strips/redacts fields that may contain headers,
request/response bodies or API keys, and returns a safe string/object (include
only error.name, error.message, and a truncated stack), then replace direct
console.error(..., error) uses in the affected locations (the console.error
calls in src/billy-agent.ts where Anthropic/OpenAI requests are made, and the
console.error sites in src/index.ts, src/conversation-store.ts,
src/analytics.ts) to call console.error(..., sanitizeError(error)); apply this
pattern everywhere exported to the tail consumer "chittytrack" to ensure no raw
error objects are forwarded.


# Observability
[observability]
enabled = true
Loading