From f29f9fcadf8828387fb32b896ff96c8b6297cea7 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 4 Jul 2026 11:48:41 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRITICAL/H?=
 =?UTF-8?q?IGH]=20Fix=20stack=20trace=20leakage?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Stopped appending `e.stack` to public Discord channel log messages to prevent sensitive information disclosure.
- Safely route the error stack to internal server logs via `console.error(e.stack)`.

Co-authored-by: DerUntote <8378077+DerUntote@users.noreply.github.com>
---
 .jules/sentinel.md | 4 ++++
 bot/bot.js         | 4 +++-
 2 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..2933f6d
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2026-07-04 - Prevent stack trace exposure in Discord error logging
+**Vulnerability:** The application was appending full error stack traces to Discord moderation log messages when debug mode was enabled.
+**Learning:** By appending error stack traces directly to messages broadcasted through an external platform API like Discord, sensitive internal server details and file paths could be exposed to unauthorized users in the log channel.
+**Prevention:** In external-facing event logging, securely log detailed stack traces internally (e.g., via `console.error(e.stack)`) while ensuring only generic or stripped down error summaries are appended to public/moderation logs.
diff --git a/bot/bot.js b/bot/bot.js
index da72836..b914b3d 100644
--- a/bot/bot.js
+++ b/bot/bot.js
@@ -190,7 +190,9 @@ function checkMessageForCommand(msg, isEdit) {
         var msgTxt = 'command ' + cmdTxt + ' failed :(';
         var linebreak = '\n-------------------------------------------------\n';
         if (config.debug) {
-          msgTxt += '\n' + e.stack;
+          // 🛡️ Sentinel: Do not append stack traces to Discord messages
+          // Log internally instead to prevent sensitive information leakage
+          console.error(e.stack);
         }
         var time = moment()
           .tz('America/Los_Angeles')