Blog

Mert Özen's blog posts on software development, backend, frontend, and DevOps.

Series

.NET Core Web API 36 Angular 31 JavaScript Basics 19 JavaScript Intermediate 18 JavaScript Advanced 16 TypeScript Basics 14 TypeScript Intermediate 14 TypeScript Advanced 12 Entity Framework Core 28 Dapper 16 Git & GitHub 29 Web Security (OWASP Top 10) 21 LLM Fundamentals 20 C# Fundamentals 20 Object-Oriented Programming in C# 16 C# Collections and Generics 11 LINQ 17 Asynchronous Programming in C# 17 Advanced C# 14 C# Versions 6 Solution Patterns 22 SOLID and Design Principles 12 Clean Code 13 Design Patterns 23 UML and Modeling 18 Introduction to Software Architecture 9 Clean, Onion and Hexagonal Architecture 8 Vertical Slice Architecture 6 Domain-Driven Design 12 CQRS and Event Sourcing 10 Messaging and Event-Driven Architecture 9 Modular Monolith 2 Microservices 10 UI Architecture Patterns 9 Architecture Decisions 7 System Design 15 Distributed Systems Fundamentals 11 Background Jobs and Scheduled Jobs 11 Working with Message Queues 14 Logging in .NET 10 Caching 10 Real-time Applications 9 ASP.NET Core MVC and Razor Pages 13 CI/CD Fundamentals 8 GitHub Actions 16 Deployment Strategies 9

2 posts found #redaction

Newest Oldest Popular

Backend PART 07

Sensitive Data in Logs: Redaction, Data Classification and Privacy-Compliant Logging

The way to keep sensitive data out of logs is to classify it and mask it automatically in the logging pipeline. Taxonomy and attributes with Microsoft.Extensions.Compliance.Redaction, [LogProperties], ErasingRedactor, your own redactor and the HMAC redactor that keeps correlation; masking with destructuring in Serilog, personal data in exception messages and a FakeLogger test that catches it, with real output.

8 Nov 2026 11 min 4

Security PART 15

OWASP A09: Security Logging and Alerting Failures — What to Log, What Never to Log

We start with a login endpoint that writes wrong passwords to the log, lets a line break forge a record and never records 403s. We move to structured logging with LoggerMessage and the JSON console, make authorization denials visible, protect the email with HMAC redaction, tie the response to the log through traceId and look at which events deserve an alert.

6 Nov 2026 8 min 12