Offer option to redact sensitive information before sharing logs

Problem

There are certain log messages that can contain sensitive information, and we want to protect users from accidentally leaking these details before sharing their logs.

Example:

• If we fail to execute a keystroke, the keystroke (or sequence of keystrokes) may contain sensitive data that the user doesn’t want to share in their logs if they post for debugging help.
• On TinyPilot Pro, users might want usernames to appear in the TinyPilot logs (e.g. user123 logged in, user123 signed out), but they’d leak sensitive information if they shared those logs.

Proposal

We add a special annotation for log calls that can log sensitive information like logger.info("[SENSITIVE] User %s logged in from %s", username, ip_address).

And then in the debug logs UI, we make a more distinct “Sharing” section and add a checkbox (off by default) labeled “Include sensitive data.” When the checkbox is unchecked, we do a regex at the JS level to strip out any log lines that include the string [SENSITIVE].

[jotaen4tinypilot]

Actually, let me re-open until https://github.com/tiny-pilot/tinypilot/pull/813 is through.

[mtlynch]

I like option (2) as well. The complexity isn’t too bad. It felt worse when we were fighting with our linters, but now that we’ve found smooth integrations with the linters, I think (2) works. If it causes problems, it’s pretty easy to back out and replace with (1) if we need to.