REDACT_PATHS

const REDACT_PATHS: ReadonlyArray<string>

Defined in: packages/core/src/logging/logging.module.ts:22

Pino redaction paths for secret material that must never appear in logs.

Each secret is listed twice: once at the record root and once with a single-segment wildcard (*). pino’s * matches a single path segment (so *.adminToken redacts obj.adminToken but not the root adminToken), and we want the redaction to fire regardless of where the caller attaches the field.

The list intentionally covers both config-shaped keys (adminToken, authorization, apiKey) and the common environment-variable casing (OPENAI_API_KEY) because callers occasionally pass process.env values through structured logging.

Keeping this list here (instead of in a per-consumer config) ensures the redaction applies to every NestJS logger in the application graph and to the HTTP request logger attached by nestjs-pino.