Blog
What Not to Put in an Error Probe (PCI, Secrets, and Source Dumps)
A practical deny-list for SDK and CLI probes: payment data, secrets, health records, and why stuffing metadata 'for context' becomes your next incident.
2026-09-29 · 6 min read · AethelLayer
The stack is enough. The wallet is not.
Teams instrumenting a payments SDK sometimes attach the full request body 'so DX can reproduce.' That is how card data ends up in a third-party inbox. AethelLayer’s acceptable use policy forbids payment cards, government IDs, and health records in probe payloads. We will not make that optional.
Send the error code, the endpoint, the timeout, the region. Do not send the PAN.
Secrets hide in helpful metadata
Authorization headers, .env dumps, compose files with tokens, and 'repro scripts' that export AWS keys are the usual accidents. If you would rotate the value after a Slack screenshot, do not put it in metadata.
Our ingest will store what you send. The control is at the probe. Design the wrap so redaction happens before the POST.
Source trees are not context
A 200-line stack is context. A zip of the repo is a data-retention problem. Keep Memory Graph nodes as errors, runtimes, and fixes — not as a mirror of customer source.
Keep reading
Capture the failure before they leave
Capture the failure before they leave. Book early access or talk to sales, then install @aethellayer/sdk when you are onboarded.