One error log, a full card number inside

transcript

A refund fails. The service logs one line. With the customer's full card number in it.

It's headed to the console and to alerting. The card must never leave the process. Mask it. Keep the first four digits and the last four. The UPI id keeps its first letter. And the part after the at sign.

Every record walks a chain. Each link passes it on, changes it, or stops it. The redactor is a link. It returns a cleaned copy. Never edits in place. Only then is it published. So every sink, present or future, only sees the clean copy.

The console prints a plain line. Card masked. The alerting sink gets JSON. Masked there too. Same clean record.

But here's the classic mistake. Redacting only the message. The card number leaks through the context fields instead. Clean both.

Redact in the chain, before publish. Message and context. Then no sink ever sees a card number.

Full breakdown in the lecture.