diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..2933f6d --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2026-07-04 - Prevent stack trace exposure in Discord error logging +**Vulnerability:** The application was appending full error stack traces to Discord moderation log messages when debug mode was enabled. +**Learning:** By appending error stack traces directly to messages broadcasted through an external platform API like Discord, sensitive internal server details and file paths could be exposed to unauthorized users in the log channel. +**Prevention:** In external-facing event logging, securely log detailed stack traces internally (e.g., via `console.error(e.stack)`) while ensuring only generic or stripped down error summaries are appended to public/moderation logs. diff --git a/bot/bot.js b/bot/bot.js index da72836..b914b3d 100644 --- a/bot/bot.js +++ b/bot/bot.js @@ -190,7 +190,9 @@ function checkMessageForCommand(msg, isEdit) { var msgTxt = 'command ' + cmdTxt + ' failed :('; var linebreak = '\n-------------------------------------------------\n'; if (config.debug) { - msgTxt += '\n' + e.stack; + // 🛡️ Sentinel: Do not append stack traces to Discord messages + // Log internally instead to prevent sensitive information leakage + console.error(e.stack); } var time = moment() .tz('America/Los_Angeles')