Keeping secrets and personal data out of logs

Observability and operations Junior Python 3.13+ PostgreSQL 17+ Reviewed By Best Latest Apps

Predict the output

What does the redactor print?

Python 3.13
SENSITIVE = {"authorization", "password", "cookie"}


def redact(h: dict[str, str]) -> dict[str, str]:
    return {k: "[redacted]" if k.lower() in SENSITIVE else v
            for k, v in h.items()}


print(redact({"Authorization": "Bearer abc", "Accept": "json"}))

Options
Hint 1 of 1

What does k.lower() return?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A {'Authorization': '[redacted]', 'Accept': 'json'}

Correct. Matching is case-insensitive via lower().

HTTP header names aren't case-sensitive, so the redactor lowercases each key before checking the deny list. Authorization matches and its value is replaced; Accept passes through.

Why not the others?
  • B {'Authorization': 'Bearer abc', 'Accept': 'json'}. lower() makes 'Authorization' match.
  • C {'Accept': 'json'}. Keys are kept; values are replaced.
  • D {'Authorization': '[redacted]', 'Accept': '[redacted]'}. Accept isn't sensitive.

30-second answer

Logs are copied widely, kept long and read by many people, so treat them as semi-public. Log ids, not personal values; never log request bodies or headers wholesale; redact known sensitive fields (Authorization, cookies, password, card numbers) in the logging layer with an allow-list of what may be logged; and scrub query strings. Set retention limits and access controls, and scan logs for leaks.

Practise saying it · 25 s. No recording, just a timer

Keep PII out of logs.

Say your answer out loud, then check which of these points you covered:

  • Logs are semi-public
  • Ids, not values
  • Central redaction
  • Retention, access

Deep dive

Data protection laws (GDPR, India's DPDP Act) apply to personal data in logs too.

Error trackers capture local variables; configure scrubbing there as well.

Hash or tokenise identifiers if you need to correlate without exposing them.

Debug logging in production is a common leak path.

Common mistakes

  • Logging the whole request for debugging.
  • Tokens in URLs that land in access logs.
  • Keeping logs forever.

Senior take & follow-ups

Logs are semi-public: ids not values, central redaction, retention and access.

Follow-up questions

Think of your answer first, then open the hint.

  1. Where should redaction happen?

    Show hint

    Centrally in the logging pipeline, not by each developer.

  2. Allow-list or deny-list?

    Show hint

    Allow-list fields; deny-lists miss new ones.

Related questions

Suggest a fix if something here is wrong or out of date.