Audit logs are meant to track actions, but too often they collect more than they should. Sensitive data — passwords, credit card numbers, personal identifiers — slips in through unchecked parameters, verbose error messages, or raw payload dumps. Once inside, this data lives in places no security team wants it: backups, archives,