[devin-ai-integration]

Primary change type

• Bug fix
• Documentation
• Feature
• Tests
• Dependency update
• Maintenance or refactor

Problem and motivation

Interceptor events handed sensitive checkout data to every handle.on() listener. An event's url was the full request URL with only the placeholder card number masked, so a URL like https://user:pass@shop.example/s/<session>/pay?token=… reached listeners as is, along with any logs they write. Refusal reasons from a custom relay, and some CDP and Node error messages, were passed through unfiltered too.

Summary and scope

• Event url is now just the origin, for example https://shop.example.
• Refusal reasons outside the 13 known relay values become unrecognized. refused.reason is typed as the new exported RefusalReason.
• CDP errors use fixed messages instead of browser or transport text.

The relay still gets the full request, and retries and idempotency keys work as before. Out of scope: backend, routing and other logging.

Related work

Related issue or discussion: N/A, requested directly by @BYWallace. Builds on #1237.

Validation

pnpm --filter @sapiom/browser-pay lint — passed
pnpm --filter @sapiom/browser-pay typecheck — passed
pnpm --filter @sapiom/browser-pay build — passed
pnpm --filter @sapiom/browser-pay test — 76 tests passed
CI on 6e222e0 — all checks passed

Tests and documentation

The new interceptor.event-redaction.test.ts puts synthetic secrets in every part of the URL and checks that no event, log line or error contains them. It also checks that the relay still gets the original request. The README documents the new url contract and the known reasons.

Compatibility and release impact

• Breaking or externally visible changes: event url is origin-only, unknown refusal reasons become unrecognized, refused.reason is typed RefusalReason, and CDP error messages are fixed strings.
• Changeset: added (minor).

Security

• I have not included secrets, credentials, private data, or unsanitized logs.
• This pull request does not publicly disclose a suspected vulnerability. I
  will follow the
  Security Policy for
  private reporting.

AI assistance

• I did not use AI assistance for this change.
• I used AI assistance and have described it below.

Devin wrote the change and tests (session), and Claude Code did a cleanup pass. Both were checked with the commands under Validation.

Checklist

• I read CONTRIBUTING.md, and this contribution follows the direct-PR or issue-first policy.
• This pull request addresses one focused problem and contains no unrelated cleanup.
• I added or updated tests, or explained above why tests are not applicable.
• I ran the relevant build, typecheck, lint, and test commands, or explained
  any N/A checks above.
• I updated documentation for user-facing changes, or marked it N/A above.
• I added a Changeset for a published-package change, or explained why it is not applicable.
• I can explain and maintain every submitted change, including any AI-assisted work.

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6c7a349b-8f49-4487-ab9c-35714dad4160

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

🔄 Devin is addressing Devin Review findings

Devin Review found 2 flags on 6e222e0. Devin is making a first pass at them and will update this comment once it's done.

View findings · Follow Devin's work

[devin-ai-integration]

Devin Review found 2 potential issues.