rollbar.js icon indicating copy to clipboard operation
rollbar.js copied to clipboard

Make the config (more) secure by default: disable telemetry, scrub everything

Open basuneko opened this issue 5 years ago • 1 comments

Hi team. I’d like to resurrect #625 as I have just run into it after upgrading from an old rollbar-browser package.

First, Telemetry seems great, and we will use it; Second, it's great that it can be configured; However, due to the sensitive nature of collecting user data, I believe it should be made secure by default.

Scrubbing some known fields is good but the list of field names can't be exhaustive, and form fields don’t even have to have names. For example, majority of our forms are implemented with Vue.js and submitted as json, hence the fields are nameless and they will be submitted to rollbar by default.

IMO the default config should be

  1. Telemetry off
  2. Scrub all input values

basuneko avatar Aug 19 '19 02:08 basuneko

@bassneck Thank you for the suggestion, and linking the previous issue. We will definitely look again at these defaults.

waltjones avatar Aug 27 '19 20:08 waltjones