Incident and report trust boundary

ErrorIncident contains the original error, stack trace, source details, assessment, environment, and collected context. Classifier, Policy, Presenter, Recovery, and Observers may inspect it inside the application. Reporter never receives it.

ErrorReport contains stable strings, enums, application identity, and sanitized context. It is the only public model accepted by ErrorReporter.

Default sanitization

StrictErrorSanitizer recursively masks fields whose names suggest authorization, cookies, passwords, secrets, tokens, API keys, or sessions. It also redacts matching assignments in text. In release mode, the original error message is replaced by its runtime type.

It cannot understand every custom payload. Sensitive content under a misleading field name or inside an opaque toString() remains a risk.

Reporter review

Before enabling a Reporter, confirm that:

• every exported field has a diagnostic purpose and bounded size;
• raw request bodies, credentials, and personal data are excluded;
• transport uses authenticated encryption;
• retention and deletion policy are defined;
• Reporter failures go to a direct non-recursive destination;
• preserving another crash handler will not create duplicate remote reports.