displayName
Redact secret values in logs
rule
Run journal sinks MUST redact known secret env-var values before persistence.
scope
observability
enforcement
journal-writer
rationale
Defense in depth — even if a secret leaks into output, logs do not retain it.