How a log scrubber's fixed redaction placeholder silently corrupted a task ledger

A developer discovered that a log-scrubbing tool was incorrectly redacting task identifiers — not just secrets — because a catch-all regex flagged any high-entropy string of 35 or more characters as a likely credential. Since every redacted value was replaced with the same constant string TOKEN_REDACTED, a separate bookkeeping tool treated all affected task slugs as a single account key. This caused distinct obligations to collapse into one ledger row, which could be falsely cleared by a single completion entry, making the system report zero open promises even when real tasks remained unresolved. The same failure pattern applies broadly to error trackers, analytics pipelines, and deduplication systems that perform GROUP BY or caching downstream of a masking layer. The fix involved using grammatical position within the log — not entropy alone — to distinguish task identifiers from actual secrets before applying redaction.