Error messages put members' email addresses and forum usernames into the console's logs #250

New Issue

2026-10-22T23:04:08Z

cgalo5758 commented

2026-10-22 23:04:08 +00:00

What happens

When a request to the forum fails, times out or is cancelled, the forum client returns the HTTP library's error, whose text repeats the request address. For the lookup of a forum user by email, that address carries the email in its query (internal/integrations/discourse/client.go, do). The error reaches the linkage path's resolve and confirmation steps.

The targeted reconcile's add and remove errors name the forum username, and the forum's own error text can repeat it, for example when a user is already a member of a group (internal/integrations/discourse/workflows/activities.go).

These errors are written to the console's logs: the reconcile sweep's warning line and the worker's activity-error log. Nothing on the logging path removes personal data, and no rule says what a log line may carry. The copies Temporal keeps in its failure messages are tracked by #162.

What should happen

A log line names a person by id, never by email address, username or name, and an error that wraps a request address drops its query. The rule is written in docs/go-conventions.md, so new code follows it.

Where

internal/integrations/discourse/client.go (do), internal/integrations/discourse/linkage/linkage.go, internal/integrations/discourse/workflows/activities.go

Why it matters

Logs are kept, shipped and read with fewer controls than the database, and an address in a log line outlives the person's erasure.

### What happens When a request to the forum fails, times out or is cancelled, the forum client returns the HTTP library's error, whose text repeats the request address. For the lookup of a forum user by email, that address carries the email in its query (`internal/integrations/discourse/client.go`, `do`). The error reaches the linkage path's resolve and confirmation steps. The targeted reconcile's add and remove errors name the forum username, and the forum's own error text can repeat it, for example when a user is already a member of a group (`internal/integrations/discourse/workflows/activities.go`). These errors are written to the console's logs: the reconcile sweep's warning line and the worker's activity-error log. Nothing on the logging path removes personal data, and no rule says what a log line may carry. The copies Temporal keeps in its failure messages are tracked by #162. ### What should happen A log line names a person by id, never by email address, username or name, and an error that wraps a request address drops its query. The rule is written in `docs/go-conventions.md`, so new code follows it. ### Where `internal/integrations/discourse/client.go` (`do`), `internal/integrations/discourse/linkage/linkage.go`, `internal/integrations/discourse/workflows/activities.go` ### Why it matters Logs are kept, shipped and read with fewer controls than the database, and an address in a log line outlives the person's erasure.

cgalo5758 added the

kind

bug

area/discourse privacy labels 2026-10-22 23:04:08 +00:00

cgalo5758 referenced this issue from a commit

2026-10-22 23:32:23 +00:00

Name the person by id in a forum-link error, and date billing by Stripe's events

cgalo5758 referenced this issue

2026-10-22 23:32:30 +00:00

The Discourse webhook receiver stores members' email addresses in the raw event log #163

cgalo5758 referenced this issue

2026-10-22 23:32:30 +00:00