True point and this is probably off topic, but out of curiosity, what is the recommended approach for his point about logging messages/requests? On previous pr

True point and this is probably off topic, but out of curiosity, what is the recommended approach for his point about logging messages/requests? On previous projects, we've gone through all sorts of machinations to detect a password in our SOAP logging. This usually involves XML parsing (slow, ineffective on malformed messages) and Regexes (ineffective on malformed or "unusual" messages). I can't think of anything better, short of "you can't leak what you don't log" which is nice in theory but not always practical.