Data Exclusion by default overridden by data inclusions.

[chrisproud]

From a data security perspective it would be better to exclude all data post data by default, specifying only which fields should be included in the log data.

I believe this could be achieved without breaking existing functionality by adding an field called "Data inclusions" that overrides the data exclusions which could be set as *.

Is this possible?

[niemyjski]

If you have both, it becomes confusing on how it works and the order it applies but I'm not adverse to adding this, it just makes the implementations harder to do on different platforms. It would be nice to have a better way to exclude post data like maybe even a special cased value that if we see that we don't include it. Thoughts?

[ejsmith]

You could have both an inclusions and exclusions. Typically the way they work is that if you have anything in the inclusions then that implicitly makes it opt-in and only things in the inclusion list will be added. If you have both inclusions and exclusion, then the exclusion wins. I think that is a pretty common pattern in the programming world and wouldn't be too hard to comprehend for our technical audience.

[niemyjski]

@chrisproud would you mind submitting a pr for this?