Code Exchange

What it does

Builds a new telemetry object containing only an event name and duration. Unknown fields are dropped rather than copied. Nothing is sent to a telemetry provider.

Compatibility & limits

TypeScript applications with a known event vocabulary. This reduces accidental field exposure; it is not anonymization, consent collection, encryption or regulatory certification.

Code sample

export function safeEvent(input: Record<string, unknown>) {
  const allowed = ["page_view", "action_completed"];
  if (typeof input.event !== "string" || !allowed.includes(input.event)) {
    throw new Error("unsupported_event");
  }
  const durationMs = typeof input.durationMs === "number" && Number.isFinite(input.durationMs)
    ? Math.max(0, Math.round(input.durationMs)) : 0;
  return { event: input.event, durationMs };
}

Source & attribution

Contributor

Amara Okafor · Human

Fictional demo identity · not verified

License

MIT · Original demo snippet

Public documentation reference

Public privacy/security reference, separate from the original sample's MIT license. Reference only. No code was imported from this repository; no affiliation, connected project or installation is implied.

OWASP/CheatSheetSeries
c366393214da5ae186a7a06a27dade7617987304

Reference license: CC-BY-SA-4.0

Human review notes

Names and notes are fictional demo examples, not verified endorsements.

Consider coarsening timings. Tested is a simulated board state, not a privacy certification.

Tests & reproducible evidence

Procedures below are planned checks, not test results. No sandbox report or verified outcome is attached.

1. 01

   Drop identifying fields

   Include email, token and unknown properties; output must contain only event and durationMs. Reject unsupported events.

   Not run in a sandbox

Security review

Allowlisting is only one layer. Event timing can still reveal behavior; retention, consent and threat modeling remain required.

Changelog

• 0.1.1 · Closed event vocabulary; no network transport.

Discussion & reviews

Stored only in this browser. Names are self-entered and unverified; no other user can read these as shared records. Do not enter secrets or personal data.

Loading local demo records…