chore: back-merge main into dev (2026-06-03 hotfixes)

scripts/verify-content.ts

@@ -83,6 +83,17 @@ function listDirs(dir: string): string[] {
         .map((d) => d.name)
 }
 
+/**
+ * Receive-money-from pages render only for corridor origins that actually have
+ * a receive-from article. Mirrors RECEIVE_SOURCES in src/data/seo/corridors.ts.
+ * Without this gate, both the route index and the sitemap "expected URLs" would
+ * agree with each other on a slug that 404s at runtime (e.g. colombia, mexico).
+ */
+function gateReceiveSources(corridors: Array<{ from: string; to: string }>): string[] {
+    const origins = [...new Set(corridors.map((c) => c.from))]
+    return origins.filter((slug) => fs.existsSync(path.join(CONTENT_DIR, 'receive-from', slug, 'en.md')))
+}
+
 function getAllMdFiles(dir: string): string[] {
     const results: string[] = []
     if (!fs.existsSync(dir)) return results
@@ -192,7 +203,7 @@ function discoverRoutes(): Set<string> {
             corridors.push({ to: dest, from: origin })
         }
     }
-    const receiveSources = [...new Set(corridors.map((c) => c.from))]
+    const receiveSources = gateReceiveSources(corridors)
 
     // Check which routes actually have page.tsx files
     const hasRoute = (routePath: string) => {
@@ -704,7 +715,7 @@ function expectedSitemapUrls(): string[] {
         const fromDir = path.join(CONTENT_DIR, 'send-to', dest, 'from')
         for (const origin of listDirs(fromDir)) corridors.push({ from: origin, to: dest })
     }
-    const receiveSources = [...new Set(corridors.map((c) => c.from))]
+    const receiveSources = gateReceiveSources(corridors)
 
     for (const locale of SUPPORTED_LOCALES) {
         for (const slug of countrySlugs) {

sentry.utils.ts

@@ -82,13 +82,228 @@ export function shouldIgnoreError(event: ErrorEvent): boolean {
 }
 
 /**
- * Clean sensitive headers from events
+ * Defense-in-depth: even when call-site code (fetchWithSentry, etc) has
+ * already scrubbed payloads, walk every Sentry event one more time and
+ * redact known sensitive headers, fields, and breadcrumb data before it
+ * leaves the browser. Catches the long tail of errors that come from
+ * places we don't control (third-party SDKs, error boundaries, console
+ * spam) and might carry PII / card data / passwords in `extra`.
+ *
+ * What stays unredacted: userId, username, email, inviteCode — identity
+ * fields already shared with PostHog and intentionally queryable in
+ * Sentry too.
+ */
+const SENSITIVE_HEADERS = [
+    'authorization',
+    'cookie',
+    'set-cookie',
+    'x-auth-token',
+    'api-key',
+    'x-api-key',
+    'apikey',
+    'md-api-key',
+    'x-app-token',
+    'x-app-access-sig',
+    'x-app-access-ts',
+]
+
+/**
+ * IMPORTANT: EXACT-MATCH set. We deliberately do NOT substring-match
+ * because Peanut has first-class onchain addresses everywhere (walletAddress,
+ * recipientAddress, tokenAddress, sdaAddress, depositAddress, …) and those
+ * are public chain data that must stay visible. Substring on `address`
+ * would clobber every one. Same for `pin` / `token` / `seed` — share names
+ * with non-sensitive concepts.
+ */
+const SENSITIVE_KEYS = new Set([
+    // Secrets
+    'password',
+    'pwd',
+    'passphrase',
+    'secret',
+    'secretkey',
+    'apikey',
+    'apitoken',
+    'bearer',
+    'authtoken',
+    'jwt',
+    'token',
+    'sessiontoken',
+    'refreshtoken',
+    'accesstoken',
+    'idtoken',
+    'privatekey',
+    'mnemonic',
+    'seed',
+    'seedphrase',
+    'recoveryphrase',
+    // Card data
+    'pan',
+    'cardnumber',
+    'cvv',
+    'cvc',
+    'securitycode',
+    'cardpin',
+    'pin',
+    'cardholdername',
+    'expirydate',
+    'expirymonth',
+    'expiryyear',
+    'expmonth',
+    'expyear',
+    // Government IDs (English + Bridge long-form)
+    'ssn',
+    'socialsecurity',
+    'socialsecuritynumber',
+    'taxid',
+    'taxidentificationnumber',
+    'tin',
+    'dni',
+    'cuit',
+    'cuil',
+    'rfc',
+    'curp',
+    'nif',
+    'governmentid',
+    'governmentidnumber',
+    'documentnumber',
+    'passport',
+    'passportnumber',
+    'driverslicense',
+    'licensenumber',
+    'idnumber',
+    'nationalid',
+    'nationalidnumber',
+    // Manteca (Spanish)
+    'documento',
+    'numerodocumento',
+    'numerodedocumento',
+    // Bank accounts
+    'iban',
+    'swift',
+    'bic',
+    'sortcode',
+    'routingnumber',
+    'accountnumber',
+    'bankaccountnumber',
+    'cbu',
+    'cvu',
+    'clabe',
+    // PII — names (English + Manteca Spanish)
+    'firstname',
+    'lastname',
+    'fullname',
+    'givenname',
+    'familyname',
+    'surname',
+    'middlename',
+    'mothername',
+    'mothersmaidenname',
+    'maidenname',
+    'customerfirstname',
+    'customerlastname',
+    'nombre',
+    'apellido',
+    // PII — address. NOTE: `address` alone is NOT here — onchain addresses
+    // (walletAddress, recipientAddress, etc.) must stay visible for
+    // debugging onchain flows.
+    'streetaddress',
+    'street1',
+    'street2',
+    'street3',
+    'streetline1',
+    'streetline2',
+    'streetline3',
+    'addressline1',
+    'addressline2',
+    'addressline3',
+    'billingaddress',
+    'homeaddress',
+    'mailingaddress',
+    'residentialaddress',
+    'permanentaddress',
+    'direccion',
+    'domicilio',
+    'postalcode',
+    'zipcode',
+    'zip',
+    'postcode',
+    'dob',
+    'dateofbirth',
+    'birthdate',
+    'birthday',
+    'phonenumber',
+    'mobilenumber',
+    'telephone',
+    'telefono',
+    // 2FA
+    'otp',
+    'verificationcode',
+    'totpsecret',
+    'twofactor',
+    'twofactorsecret',
+])
+
+function isSensitiveKey(key: string): boolean {
+    return SENSITIVE_KEYS.has(key.toLowerCase().replace(/[_-]/g, ''))
+}
+
+function scrubObject(value: unknown, depth = 0): unknown {
+    if (depth > 10) return '[REDACTED: max depth]'
+    if (value === null || value === undefined) return value
+    if (typeof value !== 'object') return value
+    if (Array.isArray(value)) return value.map((item) => scrubObject(item, depth + 1))
+    // Prototype-pollution defense — see src/utils/sentry.utils.ts for the
+    // full rationale. Object.create(null) + Object.defineProperty + explicit
+    // dangerous-key skip. The defineProperty form is what CodeQL recognises
+    // as a sanitizer; direct `out[key] = …` triggers the alert even when
+    // keys are validated at runtime.
+    const out: Record<string, unknown> = Object.create(null)
+    for (const [key, val] of Object.entries(value as Record<string, unknown>)) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue
+        Object.defineProperty(out, key, {
+            value: isSensitiveKey(key) ? '[REDACTED]' : scrubObject(val, depth + 1),
+            writable: true,
+            enumerable: true,
+            configurable: true,
+        })
+    }
+    return out
+}
+
+/**
+ * Clean sensitive headers, extras, request data, and breadcrumbs from events
+ * before they leave the browser.
  */
 export function cleanSensitiveHeaders(event: ErrorEvent): void {
     if (event.request?.headers) {
-        delete event.request.headers['Authorization']
-        delete event.request.headers['api-key']
-        delete event.request.headers['cookie']
+        for (const key of Object.keys(event.request.headers)) {
+            if (SENSITIVE_HEADERS.includes(key.toLowerCase())) {
+                event.request.headers[key] = '[REDACTED]'
+            }
+        }
+    }
+    if (event.request?.data) {
+        event.request.data = scrubObject(event.request.data)
+    }
+    if (event.extra) {
+        event.extra = scrubObject(event.extra) as Record<string, unknown>
+    }
+    if (event.contexts) {
+        for (const [key, value] of Object.entries(event.contexts)) {
+            if (key === 'trace') continue
+            ;(event.contexts as Record<string, unknown>)[key] = scrubObject(value)
+        }
+    }
+    if (event.breadcrumbs) {
+        event.breadcrumbs = event.breadcrumbs.map((crumb) => ({
+            ...crumb,
+            data: crumb.data
+                ? (Object.fromEntries(
+                      Object.entries(crumb.data).map(([k, v]) => [k, isSensitiveKey(k) ? '[REDACTED]' : scrubObject(v)])
+                  ) as Record<string, unknown>)
+                : crumb.data,
+        }))
     }
 }
 

src/app/(mobile-ui)/add-money/[country]/bank/page.tsx

@@ -38,6 +38,7 @@
 import { ANALYTICS_EVENTS } from '@/constants/analytics.consts'
 import { addMoneyCountryUrl } from '@/utils/native-routes'
 import { useSafeBack } from '@/hooks/useSafeBack'
+import { getRegionIntent } from '@/utils/regions.utils'
 
 // Step type for URL state
 type BridgeBankStep = 'inputAmount' | 'showDetails'
@@ -62,7 +63,7 @@
     // Local UI state (not URL-appropriate - transient)
     const [showWarningModal, setShowWarningModal] = useState<boolean>(false)
     const [showKycModal, setShowKycModal] = useState<boolean>(false)
     const [isRiskAccepted, setIsRiskAccepted] = useState<boolean>(false)
     const { setError, error, setOnrampData, onrampData } = useOnrampFlow()
 
     const { balance } = useWallet()
@@ -71,7 +72,8 @@
 
     // inline sumsub kyc flow for bridge bank onramp
     // regionIntent is NOT passed here to avoid creating a backend record on mount.
-    // intent is passed at call time: handleInitiateKyc('STANDARD')
+    // intent is passed at call time, derived from the destination country
+    // (e.g. /add-money/usa → NA → bridge-requirements).
     const sumsubFlow = useMultiPhaseKycFlow({
         onKycSuccess: () => {
             setUrlState({ step: 'inputAmount' })
@@ -119,7 +121,7 @@
 
     useEffect(() => {
         fetchUser()
     }, [])
 
     const peanutWalletBalance = useMemo(() => {
         return balance !== undefined ? formatAmount(formatUnits(balance, PEANUT_WALLET_TOKEN_DECIMALS)) : ''
@@ -418,7 +420,7 @@
                             await sumsubFlow.handleSelfHealResubmit('BRIDGE')
                         } else {
                             await sumsubFlow.handleInitiateKyc(
-                                'STANDARD',
+                                getRegionIntent(selectedCountry?.region ?? 'rest-of-the-world'),
                                 undefined,
                                 gate.kind === 'needs-enrollment' || undefined
                             )

src/app/(mobile-ui)/add-money/__tests__/add-money-states.test.tsx

@@ -256,6 +256,7 @@ jest.mock('@/constants/countryCurrencyMapping', () => ({
     ],
     isNonEuroSepaCountry: jest.fn(() => false),
     isUKCountry: jest.fn(() => false),
+    getFlagUrl: jest.fn((iso2: string) => `/flags/${iso2}.svg`),
 }))
 
 // Rhino consts
@@ -681,6 +682,7 @@ jest.mock('@/components/AddMoney/consts', () => ({
         { type: 'country', id: 'XX', path: 'unknown', currency: 'USD', iso3: 'XXX' },
     ],
     ALL_COUNTRIES_ALPHA3_TO_ALPHA2: { ARG: 'AR', BRA: 'BR', USA: 'US', DEU: 'DE', MEX: 'MX', GBR: 'GB' },
+    BRIDGE_ALPHA3_TO_ALPHA2: { USA: 'US', DEU: 'DE', MEX: 'MX', GBR: 'GB' },
 }))
 
 jest.mock('@/components/TransactionDetails/transactionTransformer', () => ({}))

src/app/(mobile-ui)/withdraw/[country]/bank/page.tsx

@@ -38,7 +38,7 @@ import { getKycModalVariant, getGateUserMessage } from '@/utils/capability-gate'
 import { useModalsContext } from '@/context/ModalsContext'
 import ExchangeRate from '@/components/ExchangeRate'
 import countryCurrencyMappings, { isNonEuroSepaCountry } from '@/constants/countryCurrencyMapping'
-import { isBridgeSupportedCountry } from '@/utils/regions.utils'
+import { isBridgeSupportedCountry, getRegionIntent } from '@/utils/regions.utils'
 import { PointsAction } from '@/services/services.types'
 import { usePointsCalculation } from '@/hooks/usePointsCalculation'
 import { parseUnits } from 'viem'
@@ -533,7 +533,7 @@ export default function WithdrawBankPage() {
                         await sumsubFlow.handleSelfHealResubmit('BRIDGE')
                     } else {
                         await sumsubFlow.handleInitiateKyc(
-                            'STANDARD',
+                            getRegionIntent(getCountryFromPath(country)?.region ?? 'rest-of-the-world'),
                             undefined,
                             gate.kind === 'needs-enrollment' || undefined
                         )