Q: Your logs accidentally contain passwords, access tokens, and customer PII. What controls do you put in place?

I would fix this at multiple layers because relying on one filter is risky.

• Application allowlisting: Log known-safe fields instead of dumping full request bodies or objects.
• Redaction middleware: Mask fields such as password, authorization, cookie, token, ssn, and credit_card.
• Collector-side filtering: Add Fluent Bit, Logstash, or OpenTelemetry Collector processors to redact known patterns before export.
• Access control: Restrict who can query sensitive logs and audit log searches.

The best answer is prevention in application logging, with pipeline redaction as a backup.

• Retention policy: Shorten retention for sensitive sources and route regulated data to compliant storage only when required.
• Tests: Add unit or integration tests that fail if known secret field names are emitted.