Secrets and Audit Logs

Useful logs without leaked credentials

An audit log records what happened so a person can review it later. Include request IDs, tool names, decisions, durations, outcomes, and arguments with sensitive parts removed. Do not include a dump of all environment variables, API keys, authorization headers, credential files, or full sensitive prompts.

Redaction replaces secret text with a safe marker such as [REDACTED]. Redact before writing, because deleting a secret later may miss backups or copied logs. Test with a fake canary secret made only to detect leaks, then search every generated log and artifact for it. Restrict who can read the files and how long they are kept.

Goal: The final graded lab begins with an agent that logs an API key. Repair the code, rotate the sample credential, and prove the canary is absent from new logs.