Guides
Production Safety, Guardrails & Security Compliance
A comprehensive guide on how InSitu protects your application performance and secures production data.
As a production-grade debugging system, InSitu is designed from the ground up under two absolute rules:
Never crash or slow down the host application.
Never leak sensitive data outside the container boundary.
This document provides our deep technical specifications on safety, guardrails, and secure data sanitization to share with your operations and InfoSec teams.
🛡️ Part 1: Automated Safety Guardrails
The SDK agent runs an asynchronous safety monitor on a separate thread/event loop cycle to track host system overhead in real-time.
Agent Health States
The safety monitor maps the agent into three operational states:
🟢
GREEN:
Normal operation. All indicators are healthy.
🟡
YELLOW:
A safety limit is approaching. The response depends on the SDK.
🔴
RED:
The agent suspends probes and attempts to resume them after the cooldown period when health recovers.
Configurable Safety Thresholds
Limits and defaults depend on the SDK. See the configuration references for
Python
,
Node.js
,
Java
, and
Ruby
.
🔒 Part 2: Zero-Trust In-Process Data Redaction
InSitu applies configured redaction rules inside the application process before sending captured data.
Redaction depends on the configured patterns and what your probes capture. Review your rules and avoid capturing sensitive values.
All variable filtering, structural serialization limits, and secret redactions occur inside your container’s memory boundary.
Raw, unsanitized variables never reach network packets or leave your secure execution context.
Default Redacted Keys
By default, any variable whose key matches any of the following patterns (case-insensitive) has its value replaced with
[REDACTED]
before serialization:
password, secret, token, authorization, cookie, key, signature
Customizing Redactions
A custom key list replaces the defaults. Include the default patterns when adding your own:
Code (Node.js)
Environment Variables
InSitu
.
start
({
serviceId:
'<service-uuid-from-dashboard>'
,
environment:
process
.
env
.
NODE_ENV
,
// Your environment name (e.g. dev, staging, production). Use whatever variable contains the env value.
brokerUrl:
'https://logger.app.useinsitu.com'
,
redactKeys:
[
'password'
,
'secret'
,
'token'
,
'authorization'
,
'cookie'
,
'key'
,
'signature'
,
'apiKey'
,
'cvv'
],
redactValues:
[
process
.
env
.
STRIPE_SECRET_KEY
]
// Redact actual API key values
});
InSitu_REDACT_KEYS
=
password,secret,token,authorization,cookie,key,signature,apiKey,cvv
InSitu_REDACT_VALUES
=
sk_live_abc123,internal-token-xyz
📦 Part 3: Payload Structural Constraints
To limit the size of captured objects, InSitu applies structural limits to serialized payloads:
Setting Parameter
Env Variable
Default
What it controls
maxObjectDepth
InSitu_MAX_OBJECT_DEPTH
3
Maximum nesting depth for object properties. Excess is marked
[truncated]
.
maxArrayLength
InSitu_MAX_ARRAY_LENGTH
3
Maximum array elements captured. Excess is sliced.
maxObjectProperties
InSitu_MAX_OBJECT_PROPERTIES
50
Maximum key-value pairs captured per object.
maxStringLength
InSitu_MAX_STRING_LENGTH
1024
Maximum character length captured from string properties.
stackFrameDepth
InSitu_STACK_FRAME_DEPTH
3
Maximum call stack frames captured per snapshot.
These limits apply structurally to each variable during heap traversal. The overall telemetry event size is dynamically throttled and capped by your configured in-process
Bandwidth Cap (
bandwidthKbPerSec
)
before transmission, protecting your network from spikes.
Probe Types & Instrumentation Catalog
Previous
Troubleshooting Glossary & FAQ
Next
⌘
I
Powered by
This documentation is built and hosted on Mintlify, a developer documentation platform
Terms of Service
On this page
Back to top
🛡️ Part 1: Automated Safety Guardrails
Agent Health States
Configurable Safety Thresholds
🔒 Part 2: Zero-Trust In-Process Data Redaction
Default Redacted Keys
Customizing Redactions
📦 Part 3: Payload Structural Constraints