School · Module 6 · Lesson 3 of 4
Log errors without logging secrets
A stack trace that includes an Authorization header is a second leak.
Log request ids, user ids and Stripe object ids. Do not log full headers, bodies that may hold tokens, or provider payloads that include card fingerprints you do not need.
Use a real error tracker. Filter known secret shapes before they leave the process.
Keep backups, and test a restore once; an untested backup is a story you tell yourself.