The log line that contained a token

A debug log of an outbound request, including headers, including the authorisation header, retained for ninety days.

// the redacting processor, applied to every handler
$logger->pushProcessor(function (LogRecord $record): LogRecord {
    $keys = ['authorization', 'password', 'token', 'secret',
             'api_key', 'set-cookie'];

    return $record->with(context: $this->redact($record->context, $keys));
});

A deny list is the wrong shape and is what everybody starts with, because the alternative — logging only named fields — requires knowing what is in the payload. It caught this one and it will not catch the next field somebody invents. The follow-up that mattered more was rotating the token and shortening the retention on debug-level records to seven days.