Strip personal data from logs a scan flagged
Log lines carrying personal data, redacted at source, with assertions that the fields cannot reach the logger again.
The ticket
Remove personal data from the log statements a scan flagged, and prove those fields cannot reach the logger again.
Acceptance criteria
- Flagged fields are redacted at the call site or by the logger
- A test asserts each field is absent from the emitted output
- Log messages stay useful for debugging
- The scan reports clean
What lands as proof
A test that emits a log line containing the field and asserts it does not appear in the output.
Why teams defer it
- The logs are useful because they are detailed, and redaction feels like giving that up.
- It surfaces in a compliance review rather than a bug report, and lands in a spreadsheet instead of the backlog.
- Nothing is currently broken, which makes it hard to prioritise against work that is.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: remove personal data from the log statements a scan flagged, and prove those fields cannot reach the logger again. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means assertions that the redacted fields never reach the logger, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- None is required before the run starts. Every claim this ticket makes can be checked by machine, so the agent works straight through and a person reviews the finished pull request like any other.