Scrub personal data before an event leaves the process
Error payloads carrying user data to a third party, scrubbed in-process before they are sent.
The ticket
Remove personal data from error events before they leave the process.
Acceptance criteria
- Scrubbing runs in-process, before transmission
- A test asserts each sensitive field is absent from the outbound payload
- Request bodies and query strings are covered, not just top-level fields
- The scrub list is defined in one place
What lands as proof
A test that inspects the outbound payload and asserts each sensitive field is gone.
Why teams defer it
- The data is already flowing, so stopping it means admitting it was flowing.
- Getting the scrub list right needs a conversation with whoever owns privacy, and that person is not on the team.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: remove personal data from error events before they leave the process. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means assertions that the scrubbed fields never reach the tracker, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- The run stops once the plan is written. Somebody reads the approach and approves it before any code exists, which is the cheapest moment to redirect the work.