ENGINEERING NOTE 40 / 50 · CARD
Redact card and authentication data before logging
Redaction belongs at the logging boundary, not only in the dashboard. Sensitive data already written to log storage can spread through exports and backups.
Published by OPEN RAMBO. The engineering patterns and pseudocode illustrate designs, not a documented product API. Numerical examples are illustrative.
Prefer structured allowlists
Log operation category, safe reference, status and timing. Avoid full request and response dumps for payment endpoints. An error serializer can accidentally include headers or an upstream URL containing credentials, so inspect nested error fields too.
Use layered controls
Masking in the application is one layer; restricted log access and retention limits are others. Do not rely on a regular expression to recognize every possible secret. Keep debug logging disabled for sensitive bodies even during an incident.
Test with synthetic secrets
Insert obvious fake tokens and card-like test markers into error fixtures. Search the resulting log output and assert their absence. This checks the actual logging path without exposing real customer data or credentials in a test report.
Illustrative implementation
log.info({"operation":"card_load", "reference":safe_id,
"status":"pending", "duration_ms":elapsed})
# No headers, full card data, OTPs or raw bodies.Acceptance check
Inspect normal, exception and timeout logs. Redaction that works only on the success path is incomplete.