ruby 8 lines · 1 tab

Sanitizing logs so secrets and PII do not leak downstream

Kai Nakamura Apr 2026

1 tab

Rails.application.config.filter_parameters += [
  :password,
  :password_confirmation,
  :token,
  :authorization,
  :ssn,
  :credit_card_number,
]

1 file · ruby Explain with highlit

Logs are one of the most common unintentional data exfiltration channels. I filter secrets, tokens, and PII before they leave the process, then I keep retention and access tight downstream. If your logs are rich enough to reconstruct private sessions, they are too rich.

Related snips

ruby

payload = {
  sub: user.id,
  iss: 'https://auth.example.com',
  aud: 'codesnips-api',
  exp: 15.minutes.from_now.to_i,
  iat: Time.now.to_i,

JWT issuance and verification without common footguns

jwt authentication api

by Kai Nakamura 2 tabs

rust

use tracing::{info, instrument};

#[instrument]
fn process_request(user_id: u64) {
    info!(user_id, "Processing request");
    // Work happens here

tracing for structured logging and distributed tracing

rust observability tracing

by Marcus Chen 1 tab

bash

#!/usr/bin/env bash
set -euo pipefail

export VAULT_ADDR="https://vault.internal:8200"
export VAULT_TOKEN="${VAULT_TOKEN:?missing VAULT_TOKEN}"

Secrets management with environment isolation and Vault

secrets-management vault environment-variables

by Kai Nakamura 1 tab

typescript

import { randomBytes, createHash } from "crypto";
import jwt from "jsonwebtoken";
import { RefreshTokenStore } from "./store";

const ACCESS_SECRET = process.env.ACCESS_SECRET!;
const ACCESS_TTL = "15m";

JWT access + refresh token rotation (conceptual)

security node jwt

by codesnips 3 tabs

package files

import (
  "context"
  "time"

Presigned S3 upload URLs (AWS SDK v2)

go aws s3

by Leah Thompson 1 tab

erb

<%# private stream: turbo signs the serialized record name %>
<%= turbo_stream_from current_user %>

<section class="notifications">
  <h1>Notifications</h1>

Turbo Streams + authorization: signed per-user stream name

rails turbo hotwire

by codesnips 3 tabs

Share this code

Here's the card — post it anywhere.

Sanitizing logs so secrets and PII do not leak downstream — share card

Link copied