Redaction / masking
Hide all or part of a sensitive value before it reaches logs or screens, while leaving only the detail someone genuinely needs.
See it
What it is
Redaction removes a sensitive value from an output, usually replacing it with [REDACTED]. Masking keeps a small, useful part visible, such as 4242 for a card or s*@example.com for an email address. Both control what appears in logs, support tools, screenshots, and user interfaces; neither changes the source value by itself.
Redact when the viewer has no reason to know any part of the value, especially for passwords, session cookies, and authorization headers. Mask when a person needs just enough information to recognize which saved card, phone number, or account they are looking at. Apply the rule at the logging serializer or UI boundary so every caller gets the same safe output.
The gotcha is relying on one giant regex after logs have already been written. Secrets take too many shapes, and free-text messages can hide them anywhere. Prefer structured fields, allowlist what may be logged, and test nested objects and error payloads. In a UI, masking is only presentation: the browser must not receive the full value unless the user is authorized to reveal it.
Ask AI for it
Add redaction and masking at every output boundary in this application. Configure Pino's redact.paths option for req.headers.authorization, req.headers.cookie, password, access_token, refresh_token, api_key, and nested variants, with remove: true so the keys are deleted rather than censored. Create typed formatters that show only the final four digits of a payment card and the minimum recognizable portion of an email or phone number. Return only masked display values from ordinary API endpoints; put any full value behind a separately authorized reveal endpoint. Add tests with nested objects, thrown errors, query strings, and mixed-case headers, then assert that raw secrets never appear in JSON logs, API responses, or rendered HTML.