PII scrubbing (log redaction)
Stripping emails, tokens, and card numbers out of logs before they are written, so your log tool is not a breach waiting to happen.
See it
What it is
Logs leak by accident. Someone logs the whole request body, an error serializes the entire user object, a stack trace captures local variables holding an Authorization header. Scrubbing sits in the logging pipeline and rewrites the dangerous parts before anything is stored: deny-list field names (password, token, authorization, ssn, card_number), regex the free-text values (emails, JWTs, API keys, card numbers), and swap them for '[REDACTED]' or a stable hash when you still need to correlate.
Do it at the source, in your logger, in Sentry's beforeSend hook, or in an OpenTelemetry collector processor. Not as a cleanup job afterwards. Once a secret reaches a third-party log store it has been shared with a vendor, replicated across regions, and copied into backups you cannot rewrite. Any token that lands in a log should be treated as compromised and rotated, even if you delete the line ten seconds later.
Gotcha: deny-lists always miss something, because a field called 'metadata' or 'notes' will eventually carry a phone number. An allow-list, where you log only the fields you explicitly named, is far safer and is one of the underrated payoffs of structured logging. Remember URLs get logged too, so a reset token in a query string is now sitting in the access log of every proxy it passed through.
Ask AI for it
Add PII scrubbing to this app's logging pipeline. Wrap the logger with a redaction layer that runs before any transport: deny-list the keys password, passwd, secret, token, access_token, refresh_token, authorization, cookie, api_key, ssn, card_number, and cvv (case-insensitive, matched at any nesting depth) and replace their values with '[REDACTED]'. Also scan free-text messages with top-level regexes for email addresses, bearer tokens, JWTs, and 13 to 19 digit card numbers passing a Luhn check. For identifiers you genuinely need while debugging, emit a stable salted hash such as user_id_hash instead of the raw value, and strip query strings from logged URLs. Apply the same rules to error reporting via a beforeSend hook, add unit tests with a fixture payload per rule, and keep the redaction pass off the request hot path.