Keep Secrets Out of the Logs

Leaked credentials in logs are a classic breach. The first line is T; each next line is a log line. Redact, in this order:

1. password=, passwd=, token=, api_key= or secret= (key in any case, at a word boundary) followed by a value up to the next whitespace or & → keep the key as written, replace the value with [REDACTED].
2. AWS access keys: AKIA followed by exactly 16 of A-Z 0-9, as a whole word → [REDACTED].
3. Bearer (any case) followed by a token of A-Za-z0-9._~+/- and optional trailing = → Bearer [REDACTED].