csg-org · landonshumway-ia · Jul 28, 2026 · Jul 28, 2026 · Jul 28, 2026 · Jul 28, 2026
diff --git a/backend/common-cdk/common_constructs/stack.py b/backend/common-cdk/common_constructs/stack.py
@@ -80,7 +80,9 @@ def license_types(self):
     @cached_property
     def common_env_vars(self):
         return {
-            'DEBUG': 'true',
+            # DEBUG-level logging can include sensitive request/response data, so it must
+            # not be enabled by default. It remains available to aid technical support teams.
+            'DEBUG': 'false',
             'ALLOWED_ORIGINS': json.dumps(self.allowed_origins),
             'COMPACTS': json.dumps(self.node.get_context('compacts')),
             'JURISDICTIONS': json.dumps(self.node.get_context('jurisdictions')),

diff --git a/backend/compact-connect/lambdas/nodejs/cognito-emails/lambda.ts b/backend/compact-connect/lambdas/nodejs/cognito-emails/lambda.ts
@@ -85,7 +85,7 @@ export class Lambda implements LambdaInterface {
         logger.info('Processing Cognito custom message event', {
             triggerSource: event.triggerSource,
             userPoolId: event.userPoolId,
-            userName: event.userName
+            userName: this.emailService.maskEmail(event.userName)
         });
 
         try {

diff --git a/backend/compact-connect/lambdas/nodejs/lib/email/base-email-service.ts b/backend/compact-connect/lambdas/nodejs/lib/email/base-email-service.ts
@@ -67,7 +67,7 @@ export abstract class BaseEmailService {
         return `${environmentVariableService.getUiBasePathUrl()}/img/email`;
     }
 
-    protected maskEmail(email: string): string {
+    public maskEmail(email: string): string {
         const at = email.indexOf('@');
 
         if (at <= 0) {
@@ -77,7 +77,7 @@ export abstract class BaseEmailService {
         return `${email[0]}***${email.slice(at)}`;
     }
 
-    protected maskEmails(emails: string[]): string[] {
+    public maskEmails(emails: string[]): string[] {
         return emails.map((email) => this.maskEmail(email));
     }
 

diff --git a/backend/compact-connect/lambdas/nodejs/lib/email/ingest-event-email-service.ts b/backend/compact-connect/lambdas/nodejs/lib/email/ingest-event-email-service.ts
@@ -17,7 +17,7 @@ export class IngestEventEmailService extends BaseEmailService {
         jurisdiction: string,
         recipients: string[]
     ) {
-        this.logger.info('Sending report email', { recipients: recipients });
+        this.logger.info('Sending report email', { recipients: this.maskEmails(recipients) });
 
         // Generate the HTML report
         const htmlContent = this.generateReport(events, compactName, jurisdiction);
@@ -31,7 +31,7 @@ export class IngestEventEmailService extends BaseEmailService {
     }
 
     public async sendAllsWellEmail(compactName: string, jurisdiction: string, recipients: string[]) {
-        this.logger.info('Sending alls well email', { recipients: recipients });
+        this.logger.info('Sending alls well email', { recipients: this.maskEmails(recipients) });
 
         // Generate the HTML report
         const report = this.getNewEmailTemplate();
@@ -52,7 +52,7 @@ export class IngestEventEmailService extends BaseEmailService {
     }
 
     public async sendNoLicenseUpdatesEmail(compactName: string, jurisdiction: string, recipients: string[]) {
-        this.logger.info('Sending no license updates email', { recipients: recipients });
+        this.logger.info('Sending no license updates email', { recipients: this.maskEmails(recipients) });
 
         // Generate the HTML report
         const report = this.getNewEmailTemplate();

diff --git a/backend/compact-connect/lambdas/nodejs/package.json b/backend/compact-connect/lambdas/nodejs/package.json
@@ -5,7 +5,7 @@
   "description": "NodeJS lambdas for CompactConnect",
   "resolutions": {
     "fast-xml-parser": "5.7.3",
-    "postcss": "8.5.12"
+    "postcss": "8.5.24"
   },
   "scripts": {
     "build": "tsc",

diff --git a/backend/compact-connect/lambdas/nodejs/yarn.lock b/backend/compact-connect/lambdas/nodejs/yarn.lock
@@ -4656,10 +4656,10 @@ ms@^2.1.1, ms@^2.1.3:
   resolved "https://registry.yarnpkg.com/ms/-/ms-2.1.3.tgz#574c8138ce1d2b5861f0b44579dbadd60c6615b2"
   integrity sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==
 
-nanoid@^3.3.11:
-  version "3.3.11"
-  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.11.tgz#4f4f112cefbe303202f2199838128936266d185b"
-  integrity sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==
+nanoid@^3.3.16:
+  version "3.3.16"
+  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.16.tgz#a04d8ec4b1f10009d2d533947aefe4293737816c"
+  integrity sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==
 
 napi-postinstall@^0.3.4:
   version "0.3.4"
@@ -4870,12 +4870,12 @@ pkg-dir@^4.2.0:
   dependencies:
     find-up "^4.0.0"
 
-postcss@8.5.12, postcss@^8.3.11:
-  version "8.5.12"
-  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.12.tgz#cd0c0f667f7cb0521e2313234ea6e707a9ec1ddb"
-  integrity sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==
+postcss@8.5.24, postcss@^8.3.11:
+  version "8.5.24"
+  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.24.tgz#01d8b032451e1b9ec41ae66eaf02843f42a720d2"
+  integrity sha512-8RyVklq0owXUTa4xlpzu4l9AaVKIdQvAcOHZWaMh98HgySsUtxRVf/chRe3dsSLqb6i40BzGRzEUddRaI+9TSw==
   dependencies:
-    nanoid "^3.3.11"
+    nanoid "^3.3.16"
     picocolors "^1.1.1"
     source-map-js "^1.2.1"
 

diff --git a/backend/compact-connect/lambdas/python/common/cc_common/data_model/data_client.py b/backend/compact-connect/lambdas/python/common/cc_common/data_model/data_client.py
@@ -122,7 +122,7 @@ def get_ssn_by_provider_id(self, *, compact: str, provider_id: str) -> str:
             raise CCInternalException(f'Expected 1 SSN index record, got {len(resp)}')
         return resp[0]['ssn']
 
-    @logger_inject_kwargs(logger, 'compact', 'jurisdiction', 'family_name', 'given_name')
+    @logger_inject_kwargs(logger, 'compact', 'jurisdiction')
     def find_matching_license_record(
         self,
         *,
@@ -146,6 +146,8 @@ def find_matching_license_record(
         :return: The matching license record if found, None otherwise
         """
         logger.info('Querying license records', compact=compact, state=jurisdiction)
+        # family_name/given_name are PII, so they are only logged at DEBUG level
+        logger.debug('Querying license records details', family_name=family_name, given_name=given_name)
 
         resp = self.config.provider_table.query(
             IndexName=self.config.license_gsi_name,
@@ -243,7 +245,7 @@ def get_provider_user_records(
         return ProviderUserRecords(resp['Items'])
 
     @paginated_query(set_query_limit_to_match_page_size=False)
-    @logger_inject_kwargs(logger, 'compact', 'provider_name', 'jurisdiction')
+    @logger_inject_kwargs(logger, 'compact', 'jurisdiction')
     def get_providers_sorted_by_family_name(
         self,
         *,
@@ -255,6 +257,8 @@ def get_providers_sorted_by_family_name(
         exclude_providers_without_privileges: bool = False,
     ):
         logger.info('Getting providers by family name')
+        # provider_name is PII, so it is only logged at DEBUG level
+        logger.debug('Getting providers by family name details', provider_name=provider_name)
 
         # Create a name value to use in key condition if name fields are provided
         name_value = None
@@ -4372,7 +4376,7 @@ def clear_provider_email_verification_data(
             logger.error('Failed to clear provider email verification data', error=str(e))
             raise CCAwsServiceException('Failed to clear provider email verification data') from e
 
-    @logger_inject_kwargs(logger, 'compact', 'provider_id', 'new_email_address')
+    @logger_inject_kwargs(logger, 'compact', 'provider_id')
     def complete_provider_email_update(
         self,
         *,