diff --git a/developer_manual/basics/logging.rst b/developer_manual/basics/logging.rst
index 03b9cd2a9e3..b53d71990cd 100644
--- a/developer_manual/basics/logging.rst
+++ b/developer_manual/basics/logging.rst
@@ -184,6 +184,42 @@ You can combine message interpolation with exception logging -- Nextcloud
 handles both.
 
 
+Keeping secrets out of stack traces
+-----------------------------------
+
+Exception stack traces can include method arguments. Mark parameters that
+accept secrets (passwords, tokens, credentials, and similar) with PHP's
+standard `#[\SensitiveParameter] <https://www.php.net/manual/en/class.sensitiveparameter.php>`_
+attribute so their values do not end up in the log:
+
+.. code-block:: php
+
+    <?php
+    namespace OCA\MyApp\Service;
+
+    class AuthService {
+        public function login(
+            string $user,
+            #[\SensitiveParameter]
+            string $password,
+        ): void {
+            // ...
+        }
+    }
+
+Since Nextcloud 36 the logger replaces these values in stack traces with the
+same placeholder it uses for other sensitive data, and also removes them where
+they are passed on to other calls further down the trace.
+
+.. deprecated:: 36
+   ``IRegistrationContext::registerSensitiveMethods()`` is deprecated in favor
+   of the ``#[\SensitiveParameter]`` attribute.
+
+.. note::
+   This only covers **stack traces**. Never put passwords, tokens, or personal
+   data into a log message (or its context array) yourself.
+
+
 Custom log file
 ---------------