summercms/.planning/todos/pending/redacting-slog-handler.md

title, date, priority, area

title	date	priority	area
Framework slog handler that redacts credentials (port RedactCredentialsTap)	2026-09-28	medium	summercms.go logging

Port Golem15\Apparatus\Classes\Logging\RedactCredentialsTap as a framework slog.Handler wrapper: redact attribute keys api_key, apikey, authorization, bearer, password, secret, token, webhook_secret, admin_password (case-insensitive, nested groups), and scrub its message regex patterns.

Also verify whether surf's error path already gives SafeExceptionResponse behaviour (generic "Internal server error" outside debug, real message logged); add a small helper only if it does not.

See .planning/notes/apparatus-dissolved-into-framework.md.