The Payment Key That Ended Up In The Logs Debugging Lab

The Payment Key That Ended Up In The LogsSecrets & AuthMediumPreparing workspaceAutosaved

00:00

Incident Dossier

The Payment Key That Ended Up In The Logs

A payments client throws when the requested amount is non-positive. The thrown error is logged to the customer-facing incident dashboard, and from there it gets forwarded both to PagerDuty and into the customer-support ticketing system. Each thrown error includes the full request, including the `authorization` header that holds the API key. The API key is a credential; it's showing up in places it must not be.

Initial failing signalPaymentError message contains the api key when amountCents is invalidExpected PaymentError.message must not contain the api key · received PaymentError.message contains 'sk_test_FAKEKEY_no_real_credential'

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Look at how PaymentError builds its message.
Notice that the entire request object is interpolated into a string passed to super().
Stop embedding the request into the user-visible message; keep it on the instance if needed for debugging.

Focus Mode

Start

src/payment-client.js

Likely area

src/payment-client.js

Progressive hints

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicSecrets & Auth

DifficultyMedium

Est. time18 min

Workspacecreating

Explorer

Preparing workspace files…

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ workspace boot

Workspace booting...