We've all done this. console.log("User login:", req.body); // Oops. Password just went to Datadog. logger.info({ user, token, session }); // Oops. Token just went to Sentry. I kept doing this in my projects. So I built a tiny npm package to fix it — fieldmasker. What it does It masks sensitive fields from any JavaScript object before it touches your logger, analytics, or API response. co