obs: Implement configurable IP masking for log privacy

[Xhristin3]

Problem Statement

The request logger (api/src/middleware/request-logger.middleware.ts) and audit interceptor (api/src/audit/audit.interceptor.ts) log full IP addresses. Under GDPR and similar regulations, IP addresses are personally identifiable information and should be masked by default in production.

Evidence

// request-logger.middleware.ts
const ip = (req.headers["x-forwarded-for"] as string | undefined)?.split(",")[0]?.trim() ?? req.ip ?? null

// audit.interceptor.ts
const ip = (req.headers["x-forwarded-for"] as string) ?? req.ip ?? ""

Impact

Full IP addresses stored in logs and audit records. Potential GDPR compliance issue. No configurable anonymization.

Proposed Solution

Add LOG_IP_MASKING env var (default: "last-octet"). Mask the last octet of IPv4 addresses and the last 64 bits of IPv6 addresses before logging or storing.

Acceptance Criteria

• IP masking enabled by default in production
• Masked: 192.168.1.42 → 192.168.1.0
• Configurable masking level (none, last-octet, full-hash)
• Audit logs store masked IPs

File Map

• api/src/middleware/request-logger.middleware.ts — mask IP
• api/src/audit/audit.interceptor.ts — mask IP
• api/src/config/env.ts — add LOG_IP_MASKING

---

Labels: observability, security
Priority: Low | Difficulty: Beginner | Estimated Effort: 1h

---

Labels: observability,security
Priority: Low | Difficulty: Beginner | Estimated Effort: 1h
Backlog ID: REPO-039

[clintjeff2]

Hello, I’m Jefferson, a full-stack developer and top open-source contributor, previously a fellow at OnlyDust. I’m interested in contributing to this issue and would be happy to help implement a solution, fix bugs, or improve features as needed. I’m ready to follow the project’s workflow and coding standards to ensure smooth collaboration.

[OlaGreat]

I'd like to take this on.

I'm a software engineer with experience in blockchain, backend systems, and open-source contribution. I've reviewed the issue and I'm confident I can deliver a clean implementation with tests covering the acceptance criteria. Happy to follow the project's existing conventions.

GitHub: github.com/OlaGreat

[nanaabdul1172]

I’d like to take this project as a software engineer. I will implement configurable IP anonymization across the request logger and audit interceptor to ensure GDPR compliance by default. I will add a LOG_IP_MASKING environment variable (defaulting to last-octet in production) and implement masking logic that supports none, last-octet, and full-hash modes. I will update both request-logger.middleware.ts and audit.interceptor.ts to ensure all stored and logged IPs are properly masked, and expose the setting via env.ts. This will ensure secure, privacy-compliant logging without affecting observability or system debugging flexibility.

[nanaabdul1172]

I’d like to take this project as a software engineer. I will implement configurable IP anonymization across the request logger and audit interceptor to ensure GDPR compliance by default. I will add a LOG_IP_MASKING environment variable (defaulting to last-octet in production) and implement masking logic that supports none, last-octet, and full-hash modes. I will update both request-logger.middleware.ts and audit.interceptor.ts to ensure all stored and logged IPs are properly masked, and expose the setting via env.ts. This will ensure secure, privacy-compliant logging without affecting observability or system debugging flexibility.

[grantfox-oss]

🦊 GrantFox — @nanaabdul1172 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #222)
2. Your PR will be reviewed by the XStreamRollz maintainers

Good luck! Track your progress on GrantFox.