Privacy-safe logging rule | DevPrompt Lab
Log enough to diagnose failures without recording credentials or private content.
rule · Security · beginner
English Tiếng ViệtA concise implementation rule for structured logs, redaction, and useful operational context.
Reusable content
Use structured logs with a stable event name and request or correlation ID where available. Never log passwords, session tokens, API keys, secret values, full payment details, or private user content. Redact sensitive fields before serialization, including nested objects. Log identifiers only when policy allows and prefer non-reversible correlation values. Keep messages useful for diagnosis without returning internal details to API clients.
Sensitive fields: {{SENSITIVE_FIELDS}}
Logging stack: {{LOGGING_STACK}}
How to use it
Add the project's actual redaction helper and retention policy when known.
Example
Good: event=project.save_failed request_id=... error_code=DB_TIMEOUT. Bad: full request body or database exception with connection credentials.