Verbose GitHub contributors API response logged in non-production environments — response contains contributor PII fields

[ooloth]

Why

The GitHub contributors API response contains PII fields beyond what the site displays (including node_id, gravatar_id, and potentially email); enabling verbose logging of the full API response in all non-production environments exposes these fields in build logs.

Current state

gatsby-config.js line 24:

verboseOutput: process.env.NODE_ENV !== 'production'

The GitHub /repos/.../contributors endpoint returns at minimum: login, id, node_id, avatar_url, html_url, type, site_admin, contributions, and potentially email. Verbose mode logs the entire response. This runs in development, test, and CI environments.

Ideal state

• verboseOutput is set to false unconditionally, OR
• The verbose log output is scoped to only the fields actually consumed by the site (login, id, html_url, avatar_url, contributions).
• The full raw GitHub API response (including node_id, gravatar_id, and any email field) does not appear in any build log.

Out of scope

• Changing which contributor fields are fetched from the API.

Starting points

• gatsby-config.js — line 24: the verboseOutput option in the gatsby-source-apiserver plugin configuration for the contributors endpoint.

QA plan

1. Run gatsby build in a non-production environment — confirm no full contributor object (with node_id, gravatar_id) appears in the build log.
2. Confirm the contributors section still renders correctly in the built site.

Done when

verboseOutput is false or the logged output contains only the fields the site actually uses, with no node_id, gravatar_id, or email fields in any build log.