Production Safety, Guardrails & Security Compliance

As a production-grade debugging system, InSitu is designed from the ground up under two absolute rules:

Never crash or slow down the host application.
Never leak sensitive data outside the container boundary.

This document provides our deep technical specifications on safety, guardrails, and secure data sanitization to share with your operations and InfoSec teams.

🛡️ Part 1: Automated Safety Guardrails

The SDK agent runs an asynchronous safety monitor on a separate thread/event loop cycle to track host system overhead in real-time.

Agent Health States

The safety monitor maps the agent into three operational states:

🟢 GREEN: Normal operation. All indicators are healthy.
🟡 YELLOW: A safety limit is approaching. The response depends on the SDK.
🔴 RED: The agent suspends probes and attempts to resume them after the cooldown period when health recovers.

Configurable Safety Thresholds

Limits and defaults depend on the SDK. See the configuration references for Python, Node.js, Java, and Ruby.

🔒 Part 2: Zero-Trust In-Process Data Redaction

InSitu applies configured redaction rules inside the application process before sending captured data. Redaction depends on the configured patterns and what your probes capture. Review your rules and avoid capturing sensitive values. All variable filtering, structural serialization limits, and secret redactions occur inside your container’s memory boundary. Raw, unsanitized variables never reach network packets or leave your secure execution context.

Default Redacted Keys

By default, any variable whose key matches any of the following patterns (case-insensitive) has its value replaced with [REDACTED] before serialization:

password, secret, token, authorization, cookie, key, signature

Customizing Redactions

A custom key list replaces the defaults. Include the default patterns when adding your own:

Code (Node.js)
Environment Variables

InSitu.start({
  serviceId: '<service-uuid-from-dashboard>',
  environment: process.env.NODE_ENV, // Your environment name (e.g. dev, staging, production). Use whatever variable contains the env value.
  brokerUrl: 'https://logger.app.useinsitu.com',
  redactKeys: ['password', 'secret', 'token', 'authorization', 'cookie', 'key', 'signature', 'apiKey', 'cvv'],
  redactValues: [process.env.STRIPE_SECRET_KEY] // Redact actual API key values
});

InSitu_REDACT_KEYS=password,secret,token,authorization,cookie,key,signature,apiKey,cvv
InSitu_REDACT_VALUES=sk_live_abc123,internal-token-xyz

📦 Part 3: Payload Structural Constraints

To limit the size of captured objects, InSitu applies structural limits to serialized payloads:

Setting Parameter	Env Variable	Default	What it controls
`maxObjectDepth`	`InSitu_MAX_OBJECT_DEPTH`	`3`	Maximum nesting depth for object properties. Excess is marked `[truncated]`.
`maxArrayLength`	`InSitu_MAX_ARRAY_LENGTH`	`3`	Maximum array elements captured. Excess is sliced.
`maxObjectProperties`	`InSitu_MAX_OBJECT_PROPERTIES`	`50`	Maximum key-value pairs captured per object.
`maxStringLength`	`InSitu_MAX_STRING_LENGTH`	`1024`	Maximum character length captured from string properties.
`stackFrameDepth`	`InSitu_STACK_FRAME_DEPTH`	`3`	Maximum call stack frames captured per snapshot.

These limits apply structurally to each variable during heap traversal. The overall telemetry event size is dynamically throttled and capped by your configured in-process Bandwidth Cap (bandwidthKbPerSec) before transmission, protecting your network from spikes.

Get Started

AI-Native Debugging

VS Code Extension

SDK Integration

Probe Types

Guides

Troubleshooting

Self-Hosting

Production Safety, Guardrails & Security Compliance

🛡️ Part 1: Automated Safety Guardrails

Agent Health States

Configurable Safety Thresholds

🔒 Part 2: Zero-Trust In-Process Data Redaction

Default Redacted Keys

Customizing Redactions

📦 Part 3: Payload Structural Constraints