What you need to know
Logs help developers identify a failing route, dependency, or request pattern. Logging full payloads can expose passwords, tokens, payment data, and private user details to everyone with log access.
How to apply it
Capture a request ID, route, safe status, duration, and error category. Redact known sensitive fields and restrict access and retention for production logs.
Common mistake to avoid
Do not log authorization headers, passwords, full form submissions, or database connection strings. Add a review when new fields are introduced.