- Max-length guard (256 chars) on incoming request IDs to prevent log bloat - Format whitelist (alphanumeric, hyphen, underscore) to prevent log injection - Replace Math.random() with crypto.randomBytes in fallback for CSPRNG
- Max-length guard (256 chars) on incoming request IDs to prevent log bloat - Format whitelist (alphanumeric, hyphen, underscore) to prevent log injection - Replace Math.random() with crypto.randomBytes in fallback for CSPRNG