---
title: "Keep personal data out of logs · Agent Wranglers"
url: https://agentwranglers.se/playbook/operations/logs/logs-without-personal-data
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep personal data out of logs

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Logs](https://agentwranglers.se/playbook/operations/logs)
- Rule: Never log passwords, tokens, full card numbers or personal details. Log IDs instead.
- How: Redact known fields in the logging library, such as `authorization`, `password` and `email`. Examples are pino's `redact` in Node.js, a logging filter in Python, or a Monolog processor in PHP. Log a customer ID instead of a name. Drop query strings from access logs. The [security testing playbook](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-data-out-of-logs) shows how to test for leaks.
- Check: Sign in, reset a password and place a test order on staging. Search the logs for the test password, token and email address. None of them appear.

Example:

```js
const log = pino({ redact: ['req.headers.authorization', 'password', 'email', 'card', '*.password', '*.email', '*.card'] });
```

```python
import logging

SECRET_FIELDS = {"authorization", "password", "email", "card"}

class RedactFields(logging.Filter):
    def filter(self, record):
        for field in SECRET_FIELDS & record.__dict__.keys():
            setattr(record, field, "[redacted]")
        return True

logging.getLogger("shop").addFilter(RedactFields())
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers operations playbook: https://agentwranglers.se/playbook/operations/logs/logs-without-personal-data`.

- Previous: [Use log levels with fixed meanings](https://agentwranglers.se/playbook/operations/logs/log-levels)
- Next: [Keep logs for a fixed time](https://agentwranglers.se/playbook/operations/logs/log-retention)
- [Logs](https://agentwranglers.se/playbook/operations/logs)