Reviews the code that writes logs, traces, and error reports. Paste the logging setup, the call sites, the request and error handlers, and the shipping config to trace secrets, tokens, personal data, and full request bodies that reach log storage, plus log injection through user input. Returns a verdict, a data-flow map from source to sink, evidence-linked findings, the smallest safe fix, and checks that prove a secret never appears in output. Written for backend developers who ship logs to a hosted service. States missing logger or sink details instead of inventing them. A code review prompt, not a live scanner or a compliance certificate.