PII Detection for GDPR & CCPA Compliance

// VULNERABLE: Dumping the entire request object to the logs
app.post('/api/checkout', async (req, res) => {
    try {
        const paymentData = req.body;
        // Logging the full payload for debugging purposes
        // This pushes raw Credit Card Numbers (PANs), CVVs, and Home Addresses
        // into Datadog, Splunk, or CloudWatch in plain text (PCI-DSS & GDPR Violation)
        console.error("Initiating payment payload:", JSON.stringify(paymentData));
        
        await PaymentProcessor.charge(paymentData);
        res.status(200).send("Success");
    } catch (err) {
        // Detailed error logs frequently capture user PII in the stack trace
        console.error("Payment failed", err); 
    }
});

// SAFE: Explicit property selection and data masking
const redactPII = require('./utils/redact');

app.post('/api/checkout', async (req, res) => {
    try {
        const { userId, currency, amount } = req.body;
        // Only log necessary, non-identifiable transactional telemetry
        console.log(`Initiating payment for user: ${userId}, amount: ${amount}`);
        
        await PaymentProcessor.charge(req.body);
    } catch (err) {
        // Mask external identifiers before sending to central logging
        const safeError = redactPII(err.message);
        logger.error("Payment failed", { error: safeError, transactionId: req.txId });
    }
});