Your logs are leaking secrets in 24 languages

Every leaked credential has the same origin story. Nobody commits password = "hunter2" to GitHub anymore — scanners catch that. What actually happens is quieter: someone writes

  logger.info({ user }, 'login ok');

and user happens to carry a session token. The code review looked fine. The log aggregator, the error tracker, and three SaaS vendors now have a copy — forever.

## Field names are the wrong abstraction

The standard fix is a redaction path list: tell pino to hide req.headers.authorization, user.password, and so on. It works until:

• the secret is in a field called note, because a support agent pasted an AWS key into a ticket;


• your app logs text in Turkish, and the field is called şifrə, not password;


• the token is inside a stack trace, not a field at all.

A blocklist of names can't see content. So I built