No wildcard request body logging for AI calls

CWE-532 (Insertion of Sensitive Information into Log File), OWASP A09 (Security Logging and Monitoring Failures), and GDPR Article 5(1)(f) (integrity and confidentiality) all apply when wildcard HTTP request body logging captures AI prompt content. HTTP interceptors configured to log all outgoing request bodies are a common debugging pattern — axios interceptors, custom fetch wrappers, and Node.js http module overrides — that developers add during development and forget to remove or scope. In an AI application, these interceptors will capture every prompt sent to the AI provider and write it to whatever log sink is configured, regardless of sensitivity.

If you have a custom fetch wrapper or HTTP interceptor around AI API calls, restrict it to logging metadata only — never the request body.

// lib/ai/fetch-client.ts
async function aiApiFetch(url: string, init: RequestInit) {
  const start = Date.now()
  const response = await fetch(url, init)
  // Log only metadata — never init.body or response body
  console.log('AI API call:', {
    path: new URL(url).pathname,
    status: response.status,
    latencyMs: Date.now() - start
  })
  return response
}

Search the codebase for request.body, req.body, init.body, and JSON.stringify(.*messages) in any file that wraps or intercepts outgoing HTTP requests. If wildcard body logging exists only inside a NODE_ENV === 'development' guard, verify the guard is present and tested in CI.