Incident Dossier

The Payment Key That Ended Up In The Logs

A payments client throws when the requested amount is non-positive. The thrown error is logged to the customer-facing incident dashboard, and from there it gets forwarded both to PagerDuty and into the customer-support ticketing system. Each thrown error includes the full request, including the `authorization` header that holds the API key. The API key is a credential; it's showing up in places it must not be.

Initial failing signalPaymentError message contains the api key when amountCents is invalidExpected behavior: PaymentError.message must not contain the api key · actual behavior: PaymentError.message contains 'sk_test_FAKEKEY_no_real_credential'

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Look at how PaymentError builds its message.
Notice that the entire request object is interpolated into a string passed to super().
Stop embedding the request into the user-visible message; keep it on the instance if needed for debugging.

Focus Mode

Start

src/payment-client.js

Likely area

src/payment-client.js

Challenge Coach

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicSecrets & Auth

DifficultyMedium

Est. time18 min

Workspacepreparing

Explorer

Loading files

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ prepare workspace

Preparing workspace