Sensitive Logging Audit

Objective

Find candidate output sinks, trace their values manually, fix demonstrated leaks at shared runtime boundaries, and prove redaction with adversarial tests.

The collector is only a syntax-based search aid. It does not resolve Python aliases or control flow, certify policy guards, or prove that an absent candidate is safe.

Workflow

1. Establish the review surface

• Work in the current checkout and preserve unrelated changes.
• Read src/agents/_debug.py, src/agents/logger.py, and the affected callers.
• Treat exception messages, arguments, tracebacks, causes, contexts, notes, names, URLs, and arbitrary values as potentially sensitive.
• Read the Python redaction validation matrix.

Run the collector tests, then collect candidates: