PII Scrubbing

Scrubbing runs before serialization. That is the important boundary. Once a field is removed there, it does not leak into transport, storage, or replay.

errorcore.init({
  scrub: {
    headers: ["authorization", "cookie"],
    env: ["DATABASE_URL", "JWT_SECRET"],
    body: ["password", "token", "ssn"],
  },
});

Review the policy whenever request schemas, auth headers, or environment contracts change.