Logging & Redaction Policy

Goals
- Provide observability while preventing leakage of secrets, PII, or copyrighted content

Redaction Rules
- Never log AWS credentials, API keys, session tokens, or secrets
- Truncate or hash article text in logs; do not print full raw HTML or full article bodies in CI logs
- Redact email addresses and obvious PII patterns where practical
- Include request IDs and S3/DynamoDB keys for traceability instead of content dumps

Levels
- INFO: high‑level pipeline progress and resource identifiers
- DEBUG: structured metadata (sizes, counts), never secrets or full content
- ERROR: succinct error messages with minimal context; prefer structured fields

Retention
- CloudWatch log retention is set minimally (e.g., 7 days) where supported


