SECURITY: API: Don't log "sensitive" parameters