With slog.Any on a whole Customer struct, why does an API token field still print in full when its type has a LogValue method?

## The scenario A nightly job loads customer records from a vendor drop. The record type is a plain struct with tags, because the same type is decoded from the vendor's JSON: ```go type Customer struct { ID string `json:"id"` Email string `json:"email"` Token Secret `json:"api_token"` } ``` `Secret` is the team's redacted string type and it has a `LogValue` method returning a placeholder. The loader logs progress with `logger.Info("customer loaded", slog.Any("customer", c))`. Days later somebody greps a day of shipped output for the vendor's key prefix and finds thousands of live tokens. ## Why the redaction did not fire An attribute is a key and a `slog.Value`. slog calls `Value.Resolve()` on **that** value. Here the value holds a `Customer`. `Customer` has no `LogValue` method, so its kind is `slog.KindAny`, `Resolve` returns it unchanged, and the whole struct is handed to the handler. Now the handler's encoder takes over, and encoders know nothing about slog's interfaces: - The JSON handler passes the struct to `encoding/json`. That package reflects over exported fields, honours `json` tags, and looks for `MarshalJSON` or `MarshalText` on each field's type. `Secret` has neither, so its underlying string is written under the key `api_token`. - The text handler formats it with `%+v`. `fmt` does consult `fmt.Stringer` on nested fields, so had `Secret` implemented `String` the text handler would have shown the placeholder. With only `LogValue`, `fmt` has nothing to call and prints the raw value. The general rule to state out loud: **resolution follows a chain of `LogValuer`s at the top of the value, and recurses into the members of a `slog.Group`, but it does not walk into the fields of an arbitrary struct.** A field's `LogValue` only fires if that field is passed as an attribute value in its own right. ## The fix that holds Move the decision to the type that is actually logged: ```go func (c Customer) LogValue() slog.Value { return slog.GroupValue( slog.String("id", c.ID), slog.String("email", c.Email), ) } ``` Three properties make this the right shape: 1. **It is a permit list.** Adding a `SSN` field to the struct next quarter changes nothing about what is logged — it is absent until someone edits this method, which is a reviewable diff in a file the security owner can watch. 2. **It is handler-independent.** Resolution happens before dispatch, so JSON, text and any custom handler all get the group. 3. **It composes.** The members of the returned group are themselves resolved, so a nested value that *is* passed as an attribute inside the group still gets its own `LogValue` applied. Check the receiver: declare it on the value receiver `func (c Customer)` unless you are certain every call site logs a `*Customer`. With a pointer receiver, logging a `Customer` value gives you a non-`LogValuer` and you are back where you started. ## Fixes that do not hold, and why - **`json:"-"` on the token field.** This works only for the JSON handler, because it is a directive to `encoding/json`. The text handler's `%+v` prints the field regardless. It also silently breaks decoding if the same struct is unmarshalled from the vendor payload. - **Unexporting the field.** `encoding/json` skips unexported fields, but `%+v` prints them, so the text handler still leaks. It also forces accessor churn through the rest of the loader. - **`ReplaceAttr` matching the key `api_token`.** A reasonable backstop, but here the attribute the handler sees is `customer`, one whole struct value — the encoder produces `api_token` deep inside a marshalled blob, well past any attribute-level hook. Key-based redaction only reaches keys slog itself created. - **"We will just not log whole structs."** Correct as a guideline, unenforceable as a control. Somebody adds a debug line during an incident and it is back. ## Proving it, and proving it stays fixed Two distinct activities: **Blast radius.** Grep a day of shipped output for the credential's shape — the vendor's key prefix, not a specific token — to find which lines, which services and which window are affected, and rotate accordingly. This is also how you discover the second and third code paths nobody remembered. **Regression.** Write a test that runs the real handler and asserts absence at the byte level: ```go var buf bytes.Buffer logger := slog.New(slog.NewJSONHandler(&buf, nil)) logger.Info("customer loaded", slog.Any("customer", fixture)) if strings.Contains(buf.String(), "sk-live-9f2c") { t.Fatalf("token leaked: %s", buf.String()) } ``` The important detail is that it encodes through a real handler into a `bytes.Buffer` rather than asserting on the `LogValue` return. A unit test of `LogValue` passes even when nothing calls it — which is the exact failure being fixed. Run the same assertion against both the JSON and text handlers, since that mismatch is how the class of bug survives.