fix: sanitize error logging to prevent credential exposure (#217)

[saurabhhhcodes]

Closes #217

Changes

New utility: src/utils/error-sanitizer.js

• sanitizeErrorForLogging(error) — Strips sensitive keys (config, request, response, headers, stack) and redacts credential patterns (GitHub tokens, Bearer tokens, API keys) from error objects before logging.
• sanitizeErrorResponse(error) — Returns a generic { error, status } envelope for HTTP responses.

Global Express error handler (src/server.js)

Added an error-handling middleware that catches uncaught errors, logs only the sanitized representation, and returns a generic Internal server error response — preventing any accidental leak of credentials or stack traces.

Route catch blocks updated

• profile.route.js — Uses sanitizeErrorForLogging in the catch handler; sends a generic detail string (not error.message) to the SVG error response.
• theme-comparison.route.js — Same sanitized logging pattern.

Tests: src/utils/error-sanitizer.test.js (28 tests)

• Handles null/undefined errors
• Strips config, request, response, headers, stack
• Redacts ghp_, gho_, github_pat_ tokens from string values
• Redacts nested sensitive strings
• Preserves safe custom properties (code, status, url)
• Survives circular references

Acceptance criteria coverage

• ✅ GitHub token never appears in HTTP response bodies
• ✅ GitHub token never appears in console.log/error output
• ✅ error.config not included in error responses (defense in depth — project uses native fetch, not Axios)
• ✅ Error responses in production return generic message, not stack trace (global error handler)

[vercel]

Someone is attempting to deploy a commit to the Dot_NotSam's projects Team on Vercel.

A member of the Team first needs to authorize it.