feat: Obfuscate potential PII in logs

[alexs-mparticle]

Background

The Logger currently outputs raw batch and event payloads at various log levels (error, warning, verbose). These payloads can include Personally Identifiable Information (PII)—data that can identify or be reasonably linked to an individual, such as email addresses, phone numbers, names, user IDs, IP addresses, or other user-level identifiers.

What Has Changed

• Adds obfuscateData method to be used when logging payloads
• Updates logger calls to to use obfuscateData method when passing in payloads that may contain PII
• Updates identity calls to target matched_identities payload for obfuscation, while allowing the rest of the identity payload to be visible for debugging
• Removes Logger from Vault to avoid spamming verbose logs

Screenshots/Video

• {Include any screenshots or video demonstrating the new feature or fix, if applicable}

Checklist

• I have performed a self-review of my own code.
• I have made corresponding changes to the documentation.
• I have added tests that prove my fix is effective or that my feature works.
• I have tested this locally.

Additional Notes

• {Any additional information or context relevant to this PR}

Reference Issue (For employees only. Ignore if you are an outside contributor)

• Closes https://go/j/SDKE-889

[Copilot]

Pull request overview

This PR reduces the risk of leaking PII by obfuscating logged payloads (events/batches/attributes/identity responses), and reduces verbose logging noise by removing Vault logging.

Changes:

• Added obfuscateData utility (with Jest coverage) to replace primitive values with type strings while preserving object/array structure.
• Updated verbose logger call sites (BatchUploader, RoktManager, IdentityAPIClient) to log obfuscated payloads instead of raw data.
• Removed Logger plumbing from Vault usage to avoid verbose log spam.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/utils.ts	Adds obfuscateData helper and exports it for use by logging call sites.
test/jest/utils.spec.ts	Adds comprehensive Jest tests for obfuscateData.
src/batchUploader.ts	Obfuscates queued event and upload batch payloads before verbose logging; removes Vault logger injection.
src/roktManager.ts	Obfuscates selectPlacements attributes in verbose logs; improves identify error formatting.
test/jest/roktManager.spec.ts	Updates expectation to match obfuscated verbose logging output.
src/identityApiClient.ts	Obfuscates identity response matched_identities in verbose logs.
src/vault.ts	Removes Logger usage from Vault internals and changes storage write error handling.
src/mp-instance.ts	Removes Vault logger injection for identity cache; adds TS type annotation for setOptOut arg.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jaissica12]

@alexs-mparticle can we pull the latest changes from the development branch? I recall exposing the processMessageQueue method in my last PR, but it still appears to be private here. We may also need to obfuscate the logger in that section as well

[rmi22186]

Perhaps we need to internally define what verbose is used for. Do we want a separate debug so that in a customer implementation, support staff and the customer know what's going on? Our docs just say verbose is: "Communicates the internal state and processes of the SDK (includes info, warnings, and errors).".

Or perhaps verbose prevents PII from showing, but then if they choose debug, it maps to verbose, but doesn't call obfuscate

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
12 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud