Bug: masking does not apply inside an error #361

Describe the bug

A secret in a string argument gets masked. The same secret inside an Error does not, and comes out in the log in full.

I found #214, which is about extra properties assigned to an error. The error's own message is a separate case, and it is masked in none of the versions I tried.

To Reproduce

tslog 4.10.2:

const { Logger } = require("tslog")

const log = new Logger({ type: "json", maskValuesRegEx: [/SECRET_[0-9]+/] })

log.info(`connecting to https://example.org/?key=SECRET_123456`)
log.error(new Error("connecting to https://example.org/?key=SECRET_123456"))

{"0":"connecting to https://example.org/?key=[***]", ...}
{"nativeError":{},"name":"Error","message":"connecting to https://example.org/?key=SECRET_123456", ...}

tslog 5.1.0:

import { Logger } from "tslog"

const log = new Logger({ type: "json", mask: { regex: [/SECRET_[0-9]+/] } })

log.info(`connecting to https://example.org/?key=SECRET_123456`)
log.error(new Error("connecting to https://example.org/?key=SECRET_123456"))

{"message":"connecting to https://example.org/?key=[***]", ...}
{"level":"ERROR", ...,"error":{"name":"Error","message":"connecting to https://example.org/?key=SECRET_123456", ...}}

The first line of each pair is masked. The second is not.

Expected behavior

An error's message masked the same way a plain string is.

Additional context

An error message often repeats the values a call was made with, which is exactly where a secret tends to show up.

We redact the finished JSON line ourselves for now, so we are not blocked. If masking is not meant to reach inside an error, a note about it in the docs would be helpful.

Node.js Version

22.23.2

OS incl. Version

macOS 14 (Darwin 23.6.0)