Privacy-Aware Observability

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R27 — OpenTelemetry traces & sensitive-data redaction

   R17 — Privacy logging

   R36 — Syft/Grype/Trivy

   R43 — OpenSSF Scorecard checks

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Implement OpenTelemetry structured logs, distributed traces, latency histograms, token/cost counters, and error metrics (C8 diagnostic inputs). Enforce automatic secret/PII redaction and retention TTLs on logs.

   Add SAST/security linting (ruff/bandit), dependency vulnerability scanning (pip-audit/grype), lockfile verification, and secret scanning (gitleaks/trufflehog) to GitHub Actions (or local CI runner).

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 48 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Redacted telemetry verification test + CI run catching a deliberately seeded test secret and vulnerable package.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R17NIST Privacy Framework↗ nist.gov

  Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P lifecycle controls.

• R27OpenTelemetry Documentation↗ opentelemetry.io

  Traces, spans, context propagation, semantic conventions, and redacting sensitive attributes.

• R36Syft, Grype & Trivy (SBOM)↗ anchore.com

  CycloneDX/SPDX SBOM generation, container image scanning, dependency vulnerability detection, and scanner limits.

• R43OpenSSF Scorecard↗ scorecard.dev

  Automated supply-chain checks: pinned dependencies, least-privilege CI tokens, branch protection, and signed releases.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOpenTelemetry (official docs)
  Handling sensitive data

  First-party guidance on scrubbing secrets and PII before export, including the collector redaction processor that deletes attributes outside an allowlist.

  R27checked 2026-11-11
• videoLightstep is now ServiceNow Cloud Observability
  Context Propagation makes OpenTelemetry awesome

  Explains how trace and span context propagates across service and job boundaries, which is how a background ingestion job's spans join the originating request trace.

  R27checked 2026-11-11
• videoDevOps & AI Toolkit
  Distributed Tracing Explained: OpenTelemetry & Jaeger Tutorial

  Builds traces with nested spans and attributes and exports them to Jaeger, the concrete harness for latency histograms, error metrics, and token counters.

  R27checked 2026-11-11
• articleBetter Stack
  The Missing Guide to OpenTelemetry Semantic Conventions

  Shows how to use collector processors to redact sensitive attributes from logs, traces, and metrics, i.e. enforcing redaction centrally instead of per service.

  R27checked 2026-11-11
• repoGitleaks (GitHub)
  Protect your secrets using Gitleaks-Action

  A drop-in CI job that scans commits for secrets and fails the build, the secret-scanning leg of the SAST/dependency/secret CI block.

  R27checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.