klaviyo-data-handling

The code implements legitimate Klaviyo privacy and consent operations and contains no clear malware or supply-chain backdoor. The primary security issue is an injection risk from interpolating an unescaped email into the DSAR filter. Additional privacy risks arise from incomplete secret redaction, raw or partially redacted identifiers in logs, shallow redaction, and long fixed retention. The irreversible deletion and subscription functions require strong caller authorization and input validation.