30 Days Gen AI Risk Trial -Start Now
Skip to main content

Developer data protection

Prepare logs for AI debugging

Before using machine logs with an AI assistant, keep the error, relevant sequence and correlation structure while removing credentials and unnecessary customer identifiers. Check the actual input path and provider account. The synthetic pack shows one useful transformation, not a general-purpose redactor or proof that every log field has been made safe.

For SRE, developers and security engineering

Aona field notesD08
Debugging excerpt
Same failure. Less disclosure.

Preserve the stack and sequence, then review the remaining context.

Entirely synthetic logs. The offline transformation is limited to this fixture and is not a production sanitizer.

01

Define the debugging question first

A production log can contain much more than the failure being investigated. State the question before exporting data: for example, why did a request report a missing quantity field after a retry? Identify the smallest time window and stack frames that help answer it.

Keep source handling inside your approved environment. Avoid copying a full log archive into an assistant and asking it to decide what was sensitive afterwards. A reduced excerpt should be understandable on its own, with relevant status codes, error names and the relationship between repeated events.

02

Separate useful context from identifiers

Review headers, cookies, query strings, payload fragments, filenames and stack values as well as obvious names or email addresses. A single request can carry a credential in one field and a customer identifier in another. Removing one does not establish that the remaining input is appropriate.

Use consistent placeholders when correlation matters. Replacing the same fictional request identifier with the same label preserves the sequence; replacing everything with unrelated text can make a retry or cross-service relationship impossible to follow. Also consider whether internal routes, timing or architecture details require owner approval.

Separate useful context from identifiers
Log elementUsually useful to the questionReview action
Exception and relevant framesFailure mechanismRetain the minimum useful stack
Repeated request identifierEvent correlationUse a consistent placeholder
Authorization and cookie valuesRarely needed for explanationRemove values
Customer fields or payloadOnly if essentialMinimise or replace with a synthetic reproduction

Source context: OAIC: Use of commercially available AI products

03

Compare the bundled raw and minimised examples

The sample contains a fictional order request, fake authorization and cookie values, an invalid-example email address, a retry and two stack frames. The minimised version keeps the error and ordering while replacing repeated identifiers consistently. Every record is synthetic.

The optional offline helper accepts only the unchanged bundled fixture, checked by its hash, and writes the transformed example to standard output. It makes no network calls and is not intended for real logs. Its fixed replacement list demonstrates this example only; it does not detect arbitrary credentials or certify an output as safe.

04

Check usefulness and permission before sharing

Compare the proposed excerpt with the debugging question. Can a reviewer still understand the failure? Have unrelated events been omitted? Does any remaining value identify a person, reveal a credential or disclose business information the task does not need? Record the owner’s decision for the selected account and service.

Australian OAIC guidance treats personal information entered into an AI system as a privacy decision and recommends caution with publicly available generative AI. Apply the organisation’s own requirements to the actual data and service. A successful text transformation does not supply legal permission, consent or a contractual safeguard.

Source context: OAIC: Use of commercially available AI products

05

Check the submission route and evidence

A pasted excerpt, uploaded log file and terminal result can follow different paths. Confirm which path the developer will use and whether the intended endpoint control evaluates it. Do not infer terminal-output coverage from a browser prompt test.

Keep the prepared excerpt separate from a support bundle or feedback submission. Those exceptional uploads may include additional conversation history or files. Record the expected policy outcome for a suitable synthetic test, then distinguish that result from the human review of a real debugging excerpt.

Source context: Claude Code: Data usage · Aona: AI security coverage

Put it into practice

Synthetic debugging-log preparation pack

Compare a raw fictional trace, a minimised version and the fields retained for diagnosis.

Entirely synthetic logs. The offline transformation is limited to this fixture and is not a production sanitizer.

Synthetic debugging-log preparation pack
FieldRaw examplePrepared example
Request correlationSYNTHETIC_REQ_004[REQUEST_1] on both lines
AuthorizationFake bearer marker[AUTH_REMOVED]
Customer emailperson@example.invalid[EMAIL_1]
Failure contextMissing quantity and two framesPreserved

Work through your review

Use the checks to organise the evidence you need. Your selections stay in this tab.

0 of 3 reviewed

Example files for this task

Keep the source material and the instructions together. You can also download the complete worksheet or matrix as CSV.

README.mdInspect
# Synthetic debugging-log preparation

All data is fictional. The example.invalid address cannot identify a real customer. Authorization and cookie strings are obvious fake markers, not credentials.

Compare synthetic-raw.log with expected-minimised.log and complete excerpt-review.md. The optional prepare_example.py uses only the unchanged bundled raw file, refuses any other content by hash and prints a fixed demonstration transformation. It performs no network calls and is not a production redactor. Do not replace the fixture with real logs.

Debugging question: why did the fictional request return a missing-quantity error after a retry? Observe that the status, time sequence, error text and stack frames remain useful without the original marker values.

## Guide and source references

Canonical guide: https://aona.ai/resources/guides/production-logs-ai-debugging/
Source review: 2026-09-21
- OAIC: Use of commercially available AI products: https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products
- Claude Code: Data usage: https://code.claude.com/docs/en/data-usage
- Aona: AI security coverage: https://aona.ai/resources/ai-security-coverage/
Download README.md
synthetic-raw.logInspect
2030-01-01T00:00:00.000Z SYNTHETIC request=SYNTHETIC_REQ_004 GET /orders/SYNTHETIC_ORDER_071 status=500 email=person@example.invalid Authorization="Bearer SYNTHETIC_AUTH_D08" Cookie="session=SYNTHETIC_COOKIE_D08"
2030-01-01T00:00:00.012Z SYNTHETIC request=SYNTHETIC_REQ_004 retry=1 error="ValueError: missing required field quantity"
  at parse_order(payload) in parser.py:18
  at handle_request() in app.py:42
Download synthetic-raw.log
expected-minimised.logInspect
2030-01-01T00:00:00.000Z SYNTHETIC request=[REQUEST_1] GET /orders/[ORDER_1] status=500 email=[EMAIL_1] Authorization="Bearer [AUTH_REMOVED]" Cookie="session=[COOKIE_REMOVED]"
2030-01-01T00:00:00.012Z SYNTHETIC request=[REQUEST_1] retry=1 error="ValueError: missing required field quantity"
  at parse_order(payload) in parser.py:18
  at handle_request() in app.py:42
Download expected-minimised.log
prepare_example.pyInspect
# Offline transformation for the bundled synthetic fixture only.
import hashlib
from pathlib import Path
import sys

source = Path(__file__).with_name("synthetic-raw.log").read_text()
if hashlib.sha256(source.encode()).hexdigest() != "5fed748badd05d428a1e56db0a121ccb8cbf3f3c2212084ac3b34a25b04166cf":
    raise SystemExit("Refusing input: use only the unchanged bundled synthetic fixture.")
replacements = {'SYNTHETIC_REQ_004': '[REQUEST_1]', 'SYNTHETIC_ORDER_071': '[ORDER_1]', 'person@example.invalid': '[EMAIL_1]', 'SYNTHETIC_AUTH_D08': '[AUTH_REMOVED]', 'SYNTHETIC_COOKIE_D08': '[COOKIE_REMOVED]'}
for old, new in replacements.items():
    source = source.replace(old, new)
sys.stdout.write(source)
Download prepare_example.py
excerpt-review.mdInspect
# Debugging excerpt review

Question: ____________________
Minimum time window and events: ____________________
Error/status and frames retained: ____________________
Repeated values requiring consistent replacement: ____________________
Credentials, cookies and unnecessary identifiers removed: ____________________
Remaining architecture or business context to review: ____________________
Service/account and submission path: ____________________
Owner decision: NOT YET REVIEWED
Control test, if applicable: UNTESTED
Evidence: ____________________

This record does not certify a real excerpt as safe or authorize disclosure.
Download excerpt-review.md

Before you proceed

Keep these distinctions clear

Removing the evidence needed to debug
Keep the minimum error and sequence that still explains the problem; document any changed values.
Treating a fixed example as a scanner
The helper refuses other inputs and replaces only known fake markers. It is not a reusable credential detector.

Apply it to employee AI use

Bring your actual data path.

Aona can help evaluate supported prompt and file submissions containing debugging context.

This does not imply inspection of every terminal output, log format, support bundle or remote development path.

Use the synthetic trace in a scoped demonstration of the intended input path and policy outcome.

Review your use case

FAQ

Questions for this decision

Can I upload the whole production log and ask AI to redact it?
That already discloses the original log to the selected service. Prepare and review the minimum needed excerpt within the approved environment first, following the organisation’s data-handling decision.
Should every identifier be replaced with a different random value?
Not if correlation is needed. Consistent placeholders can preserve relationships across lines while removing the original identifier. Review whether the relationship itself is appropriate to disclose.
Can prepare_example.py sanitize my real logs?
No. It deliberately refuses inputs that differ from the bundled synthetic file. Its purpose is to explain the transformation, not to detect arbitrary sensitive data.
Does a browser DLP test cover logs read by a coding agent?
Do not assume it does. A browser paste, file upload and agent tool result are separate paths. Confirm the supported client, policy and observable outcome for the actual workflow.

Evidence behind the guide

Sources and scope

Prepared by Aona. Sources checked 2026-09-21. The cited material supports the specific points below; it does not certify a product or your use case.

  1. OAIC: Use of commercially available AI products

    Explains privacy considerations for personal information input to commercial AI products.

    regulator · checked 2026-09-21
  2. Claude Code: Data usage

    Distinguishes ordinary use from user-initiated feedback and transcript-sharing paths.

    vendor · checked 2026-09-21
  3. Aona: AI security coverage

    Requires verification of the intended supported input path.

    vendor · checked 2026-09-21
Prepare production logs for AI debugging