Secrets slip into logs sideways. A dumped request carries the Authorization header; an error payload brings a password field along. The redact package in nurago scrubs text at the last moment before it is written, in one pass, cheap enough to run on every line. Token-exact matching masks api_key but leaves monkey alone, and re-redacting output is designed not to reveal more. https://tecnick.com/articles/nurago-redact/ #golang #infosec