Files
Sean WhalenandClaude Fable 5 579626d6ce Don't log full event bodies when Google SecOps rejects an event
Addresses the Copilot review finding on PR #790: the HTTP 400 handler
logged the entire rejected UDM event, and aggregate/failure events carry
email addresses and subjects that do not belong in application logs. Log
the event's identifying metadata (productEventType, productLogId) plus
the API's response text instead. The bisect regression test now pins the
log content: identifier present, event body absent.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-18 17:57:13 -04:00
..