Align ts-debug auction dump docs with redaction and note bid fail-open

The ts-debug comment doc on prepend_auction_debug_comment, the
auction_html_comment setting, and the [debug] example config still
described the pre-redaction behaviour (full auction result, raw adm
markup). Update all three to describe the redacted view: creatives
previewed to MAX_BID_CREATIVE_DUMP_BYTES and metadata filtered to the
fail-closed DEBUG_DUMP_METADATA_ALLOWLIST.

Narrow the SECURITY comment so it no longer implies bid-level metadata
is allowlisted; Bid.metadata/nurl/burl pass through today (safe because
aps.rs is the only writer, emitting opaque targeting keys). Fail-closed
bid allowlist tracked in #925.

Author: prk-Jr

crates/trusted-server-core/src/publisher.rs

@@ -935,10 +935,12 @@ fn redact_bid_for_dump(bid: &crate::auction::types::Bid) -> serde_json::Value {
     value
 }
 
-/// Prepend a `<!-- ts-debug: ... -->` HTML comment carrying the full auction
-/// result — pipeline stats plus every provider response, including each bid's
-/// raw `adm` creative markup — onto the shared `ad_bids_state` so it lands
-/// directly before the injected bids `<script>`. Gated by
+/// Prepend a `<!-- ts-debug: ... -->` HTML comment carrying a redacted view of
+/// the auction result — pipeline stats plus, per provider, its status, bids
+/// (each creative previewed to [`MAX_BID_CREATIVE_DUMP_BYTES`]), and allowlisted
+/// metadata — onto the shared `ad_bids_state` so it lands directly before the
+/// injected bids `<script>`. Identity-bearing metadata (notably prebid's `debug`
+/// subtree) is dropped; see [`DEBUG_DUMP_METADATA_ALLOWLIST`]. Gated by
 /// [`auction_html_comment`](crate::settings::DebugConfig::auction_html_comment);
 /// never enable in production.
 ///
@@ -960,10 +962,14 @@ pub(crate) fn prepend_auction_debug_comment(
     //
     // SECURITY: `Bid.creative` and provider metadata are attacker/partner-
     // influenced. Two layers protect the DOM:
-    //   1. `redact_response_for_dump` drops all non-allowlisted metadata (notably
-    //      the identity-bearing `debug` subtree) and previews each creative, so
-    //      the visitor's identity graph never enters the comment and one large
-    //      creative cannot dominate the payload.
+    //   1. `redact_response_for_dump` drops all non-allowlisted *response-level*
+    //      metadata (notably the identity-bearing `debug` subtree) and previews
+    //      each creative, so the visitor's identity graph never enters the
+    //      comment and one large creative cannot dominate the payload. Bid-level
+    //      fields (`Bid.metadata`, `nurl`, `burl`) are NOT yet allowlisted; they
+    //      pass through today because the only writer (`integrations/aps.rs`)
+    //      emits opaque targeting keys. Tightening this to a fail-closed bid
+    //      allowlist is tracked in #925.
     //   2. `render_dump` below neutralises HTML comment terminators and caps the
     //      total serialized size.
     //

crates/trusted-server-core/src/settings.rs

@@ -1902,11 +1902,13 @@ pub struct DebugConfig {
     #[serde(default)]
     pub ja4_endpoint_enabled: bool,
 
-    /// Inject a `<!-- ts-debug: ... -->` HTML comment before `</body>` dumping
-    /// the full per-provider auction result: pipeline stats (SSP count, mediator
-    /// status, winning bid count) plus every provider response — including each
-    /// bid's raw `adm` creative markup and provider metadata. Never enable in
-    /// production — visible in page source and injects raw HTML from SSPs.
+    /// Inject a `<!-- ts-debug: ... -->` HTML comment before `</body>` dumping a
+    /// redacted per-provider auction result: pipeline stats (SSP count, mediator
+    /// status, winning bid count) plus every provider response — each bid's
+    /// creative previewed (not the full `adm` markup) and provider metadata
+    /// filtered to a fail-closed allowlist that drops identity-bearing keys.
+    /// Never enable in production — visible in page source and injects (bounded)
+    /// raw HTML from SSPs.
     #[serde(default)]
     pub auction_html_comment: bool,
 

trusted-server.example.toml

@@ -137,11 +137,12 @@ example_segments = "segments"
 [debug]
 ja4_endpoint_enabled = false
 
-# Inject a `<!-- ts-debug: ... -->` HTML comment before `</body>` dumping the
-# per-provider auction result: pipeline stats plus every provider response,
-# including each bid's creative markup and allowlisted provider metadata.
-# Visible in page source and injects raw HTML from SSPs. NEVER enable in
-# production.
+# Inject a `<!-- ts-debug: ... -->` HTML comment before `</body>` dumping a
+# redacted per-provider auction result: pipeline stats plus every provider
+# response, with each bid's creative previewed (not the full markup) and
+# provider metadata filtered to a fail-closed allowlist.
+# Visible in page source and injects (bounded) raw HTML from SSPs. NEVER enable
+# in production.
 auction_html_comment = false
 
 [creative_opportunities]