Replace the console logging of the company identifier with a privacy-safe alternative. Specifically: 1) Do not log the full UUID '11111111-1111-1111-1111-111111111111' to the console. 2) If debugging is needed, log a redacted value or a hash (e.g., 'CompanyID: [REDACTED]' or 'CompanyID: hash(...)'). 3) Wrap all such logs behind a DEBUG flag or remove in production builds. 4) Audit all other code paths that may log user or entity identifiers (URLs, IDs) in console or telemetry. 5) If IDs must be tracked, ensure they are stored server-side and not echoed in client logs. 6) Ensure the logging library does not leak objects or handles (JSHandle@object) in logs.

In the Sentry initialization, apply a strict data-scrubbing policy: implement a beforeSend hook to remove or redact sensitive fields (e.g., event.request.url, query params, user identifiers). Ensure only non-identifying error telemetry is sent by default; implement an explicit user-consent toggle to enable telemetry; provide a privacy notice describing what data is sent and how it is used. Example: Sentry.init({ dsn: '...', beforeSend(event) { if (event.request && event.request.url) { event.request.url = ''; } // scrub other PII here return event; }, beforeSend is optional for opt-in; } })

Update the API to stop returning all fields for the empresa_design endpoint. Change the REST query to select only required columns (e.g., select=empresa_id, nome_empresa, design_id, logo_url, created_at). If using Supabase/PostgREST, modify the endpoint or create a restricted view that exposes only the allowed fields. Ensure authentication/authorization is enforced so unauthorized clients cannot access more data than necessary.