https://entire.com/gh/phaseoteam/-/trails/154/changes/Phaseo/154

Data contributions (opt-in redacted request/response samples kept for 30 days) could still store user images. This PR makes them keep no image, audio or file bytes at all. It's the code side of phase 0 of the CSAM screening plan: before we screen anything, stop holding media we don't need.

What changed

• Every data: URL is redacted, whatever its length. Before, only data URLs over 256 characters were removed, and only when they made up the whole string.
• Data URLs embedded in text are redacted too, e.g. a markdown image inside a message.
• Bare base64 is redacted. Any string of 256 or more base64 characters with no spaces becomes [REDACTED_BASE64]. This covers Anthropic source.data, Gemini inline_data.data, generated images (b64_json, image_generation_call.result) and any other format.
• Known media fields are redacted at any size: b64_json, partial_image_b64, and data next to type: "base64", mime_type, mimeType, media_type or format.
• DATA_CONTRIBUTION_REDACTION_VERSION goes to 2026-10-29-v2, so new rows can be told apart from older ones.

Why

The 10-16 CSAM review found three places where Phaseo stores image bytes: I/O logs, data contributions, and public avatars and logos. Contributions are the easiest to fix, because nothing reads the media back. Before this PR, raw base64 and short data URLs got past the redactor.

How

• redactString now runs the data-URL and bare-base64 checks before the existing secret and PII rules.
• sanitize checks each object key with its parent: isMediaBytesField catches short provider media fields that the length check would miss.
• Image URLs are unchanged: they still have their query string, fragment and credentials stripped, but are kept. They point at third-party content rather than being stored bytes, and the existing test pins this.

Before and after

Verification

• vitest run src/pipeline/classification: 37 passed. That includes two new tests: one covering each provider's media format, and one showing that short ordinary strings such as data: "hello" and IDs are kept.
• tsc --noEmit and eslint are clean on the gateway.
• Existing contribution rows are not changed.

Not in this PR

• I/O logs still store image bytes. "Open in Chat" (apps/web/src/lib/chat/logReplay.ts) rebuilds image parts from them, so stripping them is a product decision that's still open.
• The rest of phase 0 isn't code: a terms clause, NCMEC registration, and enabling the Cloudflare CSAM tool for the avatar bucket.

Model: Claude Opus 5.5 (effort unknown) · Harness: Claude Code in T3 Code

🤖 Generated with Claude Code