rollbar.js
rollbar.js copied to clipboard
Make the config (more) secure by default: disable telemetry, scrub everything
Hi team. I’d like to resurrect #625 as I have just run into it after upgrading from an old rollbar-browser package.
First, Telemetry seems great, and we will use it; Second, it's great that it can be configured; However, due to the sensitive nature of collecting user data, I believe it should be made secure by default.
Scrubbing some known fields is good but the list of field names can't be exhaustive, and form fields don’t even have to have names. For example, majority of our forms are implemented with Vue.js and submitted as json, hence the fields are nameless and they will be submitted to rollbar by default.
IMO the default config should be
- Telemetry off
- Scrub all input values
@bassneck Thank you for the suggestion, and linking the previous issue. We will definitely look again at these defaults.