>Very true. It is a constant battle between debuggability and not leaking credentials. And there are so many ways of getting bitten. Another anecdote for you:

>Very true. It is a constant battle between debuggability and not leaking credentials. And there are so many ways of getting bitten. Another anecdote for you: I recently found out that an API wasn't logging errors anywhere. Easy enough to fix, plug in a library and bam, everything is nicely logged to the database. Including the HTTP headers. Headers that include API auth tokens. Ouch.