fix(security): complete security and delivery compliance remediation

backend/app/core/logging_utils.py

@@ -0,0 +1,26 @@
+"""Logging helpers that prevent sensitive values from reaching application logs."""
+import logging
+import re
+
+_SENSITIVE_KEY = r"(?:password|passwd|secret|token|authorization|credential|client_secret|corpsecret|code)"
+_KEY_VALUE_PATTERN = re.compile(
+    rf"(?i)([\"']?{_SENSITIVE_KEY}[\"']?\s*[:=]\s*)([\"']?)([^\s,;\]\}}\"']+)([\"']?)"
+)
+_BEARER_PATTERN = re.compile(r"(?i)(authorization\s*[:=]\s*bearer\s+)[^\s,;]+")
+_QUERY_PATTERN = re.compile(rf"(?i)([?&]{_SENSITIVE_KEY}=)[^&\s]+")
+
+
+def redact_log_message(message: str) -> str:
+    """Mask common secret formats while keeping enough context for operations."""
+    masked = _BEARER_PATTERN.sub(r"\1***", message)
+    masked = _QUERY_PATTERN.sub(r"\1***", masked)
+    return _KEY_VALUE_PATTERN.sub(r"\1\2***\4", masked)
+
+
+class SensitiveDataFilter(logging.Filter):
+    """Redact sensitive values after interpolation and before formatter output."""
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        record.msg = redact_log_message(record.getMessage())
+        record.args = ()
+        return True