Structured logs for a benefits app accidentally include Authorization headers and raw SSNs. What instrumentation rule was broken?
Select an answer to reveal the explanation.
Short Explanation
Observability should not become a secret dump. Redact Authorization headers and raw SSNs—logs are not a second copy of the vault.
Full Explanation
Instrumentation must avoid writing secrets and sensitive personal data into logs or traces. Authorization headers and raw SSNs should be redacted or omitted so observability does not become a leak path. Logging tokens, plaintext secrets, or private keys in annotations violates that control.