How does HandlerOptions.ReplaceAttr let one slog handler redact an attribute anywhere in a record?

## The knob `slog.HandlerOptions` has three fields, and one of them is a rewrite hook: ```go type HandlerOptions struct { AddSource bool Level Leveler ReplaceAttr func(groups []string, a Attr) Attr } ``` You pass the options to a constructor and the handler calls your function on the way out: ```go opts := &slog.HandlerOptions{ ReplaceAttr: func(groups []string, a slog.Attr) slog.Attr { if a.Key == "api_token" || a.Key == "national_id" { return slog.String(a.Key, "REDACTED") } return a }, } logger := slog.New(slog.NewJSONHandler(os.Stdout, opts)) ``` One function, installed once where the logger is constructed, applied to every record the process emits — including records written by code nobody on your team reviewed. That coverage property is the entire reason it exists alongside `LogValuer`. ## What it is called for - **Every attribute that is not itself a group.** Group attributes are not passed to it; the members of the group are, one at a time. - **The built-in attributes** — timestamp, level, message and, when `AddSource` is on, the source location — with an empty `groups` slice and the keys `slog.TimeKey`, `slog.LevelKey`, `slog.MessageKey`, `slog.SourceKey`. Comparing against those constants rather than the literal strings is the habit to have. - **Attributes added with `Logger.With`** as well as those given at the call site. ## What the groups argument is for `groups` is the list of group keys enclosing this attribute, outermost first. For an attribute written inside a group named `vendor`, `groups` is `[]string{"vendor"}`; nested one level deeper it is `[]string{"vendor", "auth"}`; for a top-level attribute it is empty. That matters because a bare key match is a blunt instrument. `id` is harmless on a request and sensitive on a person; `secret` in a vendor block is a credential and in a build block might be a boolean. Scoping the rule to a path keeps the rule honest: ```go func replace(groups []string, a slog.Attr) slog.Attr { if len(groups) > 0 && groups[0] == "vendor" && a.Key == "secret" { return slog.Attr{} // dropped from the record entirely } return a } ``` It also lets you write a rule that only applies at the top level (`len(groups) == 0`), which is how you safely rewrite the built-in attributes without accidentally matching a user attribute that happens to be called `time`. ## Replace, or drop The return value is the attribute that gets written. Three useful shapes: - **Replace the value**: `return slog.String(a.Key, "REDACTED")` keeps the key visible so a reader can see that a field existed and was withheld. - **Drop it**: `return slog.Attr{}` removes the attribute completely. A zero `Attr` is treated as empty and is not written. - **Transform it**: return the same key with a derived value — a hash, a length, or the last four characters — when support still needs to correlate records without holding the value. ## The ordering detail people get wrong The attribute handed to `ReplaceAttr` has **already been resolved**. If the value's type implements `LogValuer`, `LogValue` ran first and your function sees the substitute, not the original. Two consequences: 1. You cannot write a `ReplaceAttr` that inspects the original secret to decide whether to redact it — by then it may already be the string `REDACTED`. 2. The two mechanisms compose in a fixed order: type-level redaction wins first, handler-level rules apply to whatever survived. That is the right order, because the type knows more than the key name does. The replacement you return is itself resolved, so returning a `LogValuer` from `ReplaceAttr` also works. ## Where it stops `ReplaceAttr` sees attributes, and only attributes slog itself constructed. It cannot reach: - **The message text.** `logger.Info(fmt.Sprintf("token %s", tok))` puts the value in the message, and while the message is passed as an attribute under `slog.MessageKey`, matching it means pattern-matching free text — a losing game. - **Inside an opaque value.** If one attribute's value is a whole struct, the encoder produces its inner keys long after your function ran. Your function saw one attribute named `customer`, not a field named `api_token`. - **Anything the process writes outside slog** — a panic's stack trace, a `fmt.Println`, a third sink. So it is a backstop, not a boundary: broad in coverage, shallow in reach. Pair it with `LogValuer` on the types that carry the sensitive values, which is deep in reach and narrow in coverage.