Prevent Secrets in Logs & Traces

The problem

Sensitive data like API keys, PII, and tokens often leak into structured logs or distributed traces due to inconsistent trust boundaries and poor serialization logic. Developers struggle to maintain observability requirements while strictly enforcing redaction across retries, error handlers, and nested objects.

What it does

• Identifies and patches insecure structured logging and error serialization paths across the repository.
• Enforces redaction for URLs, headers, and nested metadata within tracing span attributes.
• Moves validation logic before irreversible dispatch to prevent accidental exposure of raw inputs.
• Generates deterministic local fixtures and regression tests to verify secret-safe behaviors.
• Ensures compliance with existing retention policies, severity levels, and audit schemas while fixing leaks.

Why this beats prompting it yourself

Generic prompts often miss edge cases like nested object redaction or leaked data in retry loops. This skill follows a rigorous execution method to map state ownership and trust boundaries, ensuring that patches don't accidentally break your telemetry schema or audit trails.

Use cases

• Redacting sensitive fields from nested JSON objects in structured application logs.
• Securing trace attributes to prevent PII from leaking into observability platforms like Jaeger or Honeycomb.
• Patching URL and header logging to strip auth tokens before they reach the disk.
• Adding regression tests that simulate concurrent failures to ensure secrets aren't exposed during cleanup.

Known limitations

This skill operates only on repository files and local fixtures. It cannot interact with live production services or mutate deployed infrastructure.