Log hygiene is the practice of keeping sensitive data out of logs and tightly controlling who can read telemetry. Good log hygiene means redacting secrets, limiting verbose debug output, separating production logs from less trusted environments, and applying retention and access rules so logs do not become an easy data dump. In security work, logs are useful because they help detect attacks and investigate incidents, but they are also a common place for tokens, passwords, session IDs, API keys, and internal state to leak.
It matters because attackers often target logging systems as a secondary path to compromise. If a vulnerable application writes credentials, request bodies, or opaque protocol artifacts into logs, an intruder who reaches observability tools may recover material that was never meant to be stored. Defenders use log hygiene to reduce that risk: filter secrets before emission, hash or tokenize identifiers, restrict telemetry access, and audit log pipelines for accidental exposure. In AI systems, this also means treating reasoning artifacts and session metadata as sensitive, not disposable debug output.