Encore.go: does sensitive on a raw endpoint redact its headers and bodies in traces?

[agwax]

We run a Go app on Encore 1.58.6, deployed on Encore Cloud. Two of its endpoints are raw. The Go docs (Defining APIs, "Sensitive data") say that for a raw endpoint, adding sensitive to the //encore:api annotation redacts the whole request and response payload, all headers included. That's exactly what we need, since the request's Cookie header holds a session.

Reading the source at v1.58.6, we couldn't find where the Go runtime applies the flag:

• The parser and the metadata: the parser sets Endpoint.Sensitive, and it reaches the app's metadata (meta.proto#L131-L133: "none of the request/response payload will be traced").
• Codegen: it builds ScrubRequestPaths and ScrubRequestHeaders from the request and response types alone (endpointgen.go#L76-L81, #L118-L121). A raw endpoint has neither type.
• The Go runtime's request span: it records every header that isn't in ScrubRequestHeaders (trace2/events.go#L222, #L1052-L1064).
• A raw endpoint's bodies: the Go runtime captures its request and response bodies by content alone (apisdk/api/handler.go#L135-L139, capture.go#L152-L173, #L286-L288).
• The Rust runtime, for comparison: request_span_start and request_span_end skip the headers, path parameters and payload of an endpoint marked sensitive (endpoint.rs#L767, protocol.rs#L211, #L250-L261). That arrived with Add Sensitive Redaction For TypeScript #1894.

Our questions:

1. For a Go app on Encore Cloud, is the redaction applied on the platform's side, from the metadata flag, so that the documented behavior holds there? Or does the Go runtime need the change the Rust runtime got for Add Sensitive Redaction For TypeScript #1894?
2. In particular, is the Cookie header of a request to a raw endpoint marked sensitive kept out of the traces Encore Cloud stores?
3. Is per-endpoint tracing control, mentioned in Is it possible to redact sensitive fields in a TypeScript API? #1994, available or planned for Go?

This comes from reading the source, not from a test on Encore Cloud, so we may have missed where the platform handles it.

[DesolateYH]

I went through the same code and your reading holds for what the Go runtime records. What Encore Cloud does after it receives the events isn't in this repo.

Verified in source (v1.58.6):

• Endpoint.Sensitive is read in only two places: the parser (api.go#L330-L331) and the metadata conversion (legacymeta.go#L98). Nothing in v2/codegen or runtimes/go reads it, and that's still true on v1.58.8.
• For a raw endpoint all Scrub* fields come out nil (typescrub.go#L50-L53). So every request header, Cookie included, is written as-is (events.go#L1052-L1064), and so are response headers like Set-Cookie (#L263). Text-like raw bodies go out as BodyStream events (reqtrack.go#L258-L282).
• The history suggests the flag was meant to be enforced downstream. Add 'sensitive' option to //encore:api #790 added it with no runtime change, and until Pre-compute scrub paths during code generation #2267 (Feb 2026) the Go runtime scrubbed nothing at record time. Pre-compute scrub paths during code generation #2267 moved field-tag scrubbing into codegen but didn't carry the endpoint flag over.

Can't see from the repo: whether Encore Cloud's ingestion still applies rpc.sensitive. A maintainer would have to confirm that. You can also test it by sending a dummy cookie to the raw endpoint in a Cloud environment and checking the trace.

Partial workaround: since v1.58.8 (#2616), every endpoint, raw ones included, redacts Authorization plus the headers and cookies your auth handler's params declare (endpointgen.go#L84-L91, events.go#L1060-L1062). If your auth handler reads the session through a cookie:"session" field, that value is redacted when it's recorded. Bodies and other headers still aren't.

On (3): the Go runtime already honours per-endpoint sampling rates from its runtime config (traceprovider.go#L35-L92), but I can't tell whether Encore Cloud lets you set them.