From 789e2ae97acffb3e2fce10a9b693d9d5e17e5584 Mon Sep 17 00:00:00 2001
From: whoalin1 <whoalin414@gmail.com>
Date: Wed, 7 Oct 2026 01:52:14 +0300
Subject: [PATCH 1/2] docs(dev): document registerSensitiveMethods() in
 logging.rst

Assisted-by: Cursor:grok-4.7
Signed-off-by: whoalin1 <whoalin414@gmail.com>
---
 developer_manual/basics/logging.rst | 40 +++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/developer_manual/basics/logging.rst b/developer_manual/basics/logging.rst
index 03b9cd2a9e3..e2890c44f27 100644
--- a/developer_manual/basics/logging.rst
+++ b/developer_manual/basics/logging.rst
@@ -184,6 +184,46 @@ You can combine message interpolation with exception logging -- Nextcloud
 handles both.
 
 
+Keeping secrets out of stack traces
+-----------------------------------
+
+Exception stack traces can include method arguments. If your app has methods
+that accept secrets (passwords, tokens, credentials, and similar), register
+them during bootstrap so the logger replaces those arguments before writing
+the trace:
+
+.. code-block:: php
+
+    <?php
+    namespace OCA\MyApp\AppInfo;
+
+    use OCA\MyApp\Service\AuthService;
+    use OCP\AppFramework\App;
+    use OCP\AppFramework\Bootstrap\IBootContext;
+    use OCP\AppFramework\Bootstrap\IBootstrap;
+    use OCP\AppFramework\Bootstrap\IRegistrationContext;
+
+    class Application extends App implements IBootstrap {
+        public function register(IRegistrationContext $context): void {
+            $context->registerSensitiveMethods(
+                AuthService::class,
+                ['login', 'updatePassword'],
+            );
+        }
+
+        public function boot(IBootContext $context): void {
+        }
+    }
+
+``IRegistrationContext::registerSensitiveMethods()`` takes the fully qualified
+class name and an array of method names. It has been available since Nextcloud
+25.
+
+.. note::
+   This only covers **stack traces**. Never put passwords, tokens, or personal
+   data into a log message (or its context array) yourself.
+
+
 Custom log file
 ---------------
 

From e7cdeea135751c05ee4682238a5080cc75e20b8a Mon Sep 17 00:00:00 2001
From: whoalin1 <whoalin414@gmail.com>
Date: Fri, 23 Oct 2026 19:43:30 +0300
Subject: [PATCH 2/2] docs(dev): recommend #[\SensitiveParameter] instead of
 registerSensitiveMethods()

registerSensitiveMethods() is deprecated since Nextcloud 36
(nextcloud/server#65412); document the standard PHP attribute instead.

Assisted-by: Cursor:grok-4.7
Signed-off-by: whoalin1 <whoalin414@gmail.com>
---
 developer_manual/basics/logging.rst | 42 +++++++++++++----------------
 1 file changed, 19 insertions(+), 23 deletions(-)

diff --git a/developer_manual/basics/logging.rst b/developer_manual/basics/logging.rst
index e2890c44f27..b53d71990cd 100644
--- a/developer_manual/basics/logging.rst
+++ b/developer_manual/basics/logging.rst
@@ -187,37 +187,33 @@ handles both.
 Keeping secrets out of stack traces
 -----------------------------------
 
-Exception stack traces can include method arguments. If your app has methods
-that accept secrets (passwords, tokens, credentials, and similar), register
-them during bootstrap so the logger replaces those arguments before writing
-the trace:
+Exception stack traces can include method arguments. Mark parameters that
+accept secrets (passwords, tokens, credentials, and similar) with PHP's
+standard `#[\SensitiveParameter] <https://www.php.net/manual/en/class.sensitiveparameter.php>`_
+attribute so their values do not end up in the log:
 
 .. code-block:: php
 
     <?php
-    namespace OCA\MyApp\AppInfo;
-
-    use OCA\MyApp\Service\AuthService;
-    use OCP\AppFramework\App;
-    use OCP\AppFramework\Bootstrap\IBootContext;
-    use OCP\AppFramework\Bootstrap\IBootstrap;
-    use OCP\AppFramework\Bootstrap\IRegistrationContext;
-
-    class Application extends App implements IBootstrap {
-        public function register(IRegistrationContext $context): void {
-            $context->registerSensitiveMethods(
-                AuthService::class,
-                ['login', 'updatePassword'],
-            );
-        }
+    namespace OCA\MyApp\Service;
 
-        public function boot(IBootContext $context): void {
+    class AuthService {
+        public function login(
+            string $user,
+            #[\SensitiveParameter]
+            string $password,
+        ): void {
+            // ...
         }
     }
 
-``IRegistrationContext::registerSensitiveMethods()`` takes the fully qualified
-class name and an array of method names. It has been available since Nextcloud
-25.
+Since Nextcloud 36 the logger replaces these values in stack traces with the
+same placeholder it uses for other sensitive data, and also removes them where
+they are passed on to other calls further down the trace.
+
+.. deprecated:: 36
+   ``IRegistrationContext::registerSensitiveMethods()`` is deprecated in favor
+   of the ``#[\SensitiveParameter]`` attribute.
 
 .. note::
    This only covers **stack traces**. Never put passwords, tokens, or personal