# The agent added debug logging and wrote the Authorization header to plaintext logs

A downstream call kept failing, so the agent added a log line that printed the outgoing request to make it traceable. The intent was reasonable: see the method, path, and headers on a retry. The implementation printed the whole header map, and the Authorization bearer token rode straight into plaintext logs on every attempt.

Nothing failed loudly for the agent. Tests use a dummy token, no test asserts what the logger writes, and code review glances at a new log statement and moves on. The leak does not appear in the browser response, so it stays invisible until someone opens the centralized log stream and finds the real bearer token sitting in retained entries.

## Log the shape of the request, never its credentials

Use an allowlist of safe headers instead of dumping the map. Strip Authorization, Cookie, and Proxy-Authorization entirely; if an identity hint is needed, record the scheme and a masked tail such as bearer ab12**** rather than the token. Apply the same treatment to the body: mask password, api_key, token, and refresh fields before the object reaches the logger.

A shared redaction helper makes the rule cheap to obey everywhere, and a small fixture test that feeds a fake secret and asserts the logged output does not contain it catches regressions without relying on a reviewer to remember. If a token already reached retained logs, rotate it rather than trust retention controls alone; deleting the entry does not erase copies downstream.

The debugging value was never in the secret, only in the shape of the request. Where would your team catch a token written to logs today?