From 5c40720211ab29bf7ade60052388d6900fb2111e Mon Sep 17 00:00:00 2001
From: Thomas Rademaker <thomas@radmakr.com>
Date: Fri, 1 May 2026 12:46:53 -0400
Subject: [PATCH] Log only the URL path

---
 appview/server.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/appview/server.go b/appview/server.go
index dca16bb..e4a5ce1 100644
--- a/appview/server.go
+++ b/appview/server.go
@@ -116,13 +116,13 @@ func NewServer(cfg Config) (*Server, error) {
 	e.Use(middleware.Recover())
 	e.Use(middleware.RequestLoggerWithConfig(middleware.RequestLoggerConfig{
 		LogStatus:   true,
-		LogURI:      true,
 		LogMethod:   true,
 		LogRemoteIP: true,
 		LogValuesFunc: func(c echo.Context, v middleware.RequestLoggerValues) error {
+			// Log only the URL path; query strings can carry credentials and must not land in logs.
 			logger.Info("request",
 				"method", v.Method,
-				"uri", v.URI,
+				"path", c.Request().URL.Path,
 				"status", v.Status,
 				"ip", v.RemoteIP,
 			)
-- 
2.51.2