VulCode

Monolog: our changes to an open source project

The most popular PHP logging library, used by Symfony and Laravel among others.

All contributions
Language
PHP
GitHub stars
21,399
1merged change
Merged on 9 September 2026.
Number 8 of the 64 GitHub projects with our changes, by stars. First is Zed (91,587).

The change merged into Monolog

RedactingFormatter now also hides secrets nested inside array values under sensitive keys.

How we tested it

A new test runs a record through PsrLogMessageProcessor and then through RedactingFormatter, and checks that the secret nested in the array does not appear in the output and that [REDACTED] does.

PHP

Our projects in this technology, their screens and when we choose it.

The bug, the fix and the lesson

A summary of our Tech news write-up: what was broken, what we changed and what it means for our own work.

What was broken

A password inside an array reached the log

RedactingFormatter only collected strings to hide. When the value under password was an array, the processor put it into the message, and the password stayed there in plain text.

$log->info('password reset payload: {password}', ['password' => ['new' => 'CorrectHorseBatteryStaple42']]);
What we changed

Secrets collected at any depth

A new helper, collectSensitiveValue(), walks the value under a sensitive key and collects every string, within the same MAX_DEPTH limit.

What it taught us

Redacting secrets in logs has to walk into nested data.

A key marked sensitive is sensitive even when its value is an array.

Other projects with our changes: PHP

20 projects in this technology have our merged changes. The bar is the repository's stars, next to it the number of our changes. Each row leads to the project's page.

PHP
The other 12 on the list of all contributions

Questions about our changes to Monolog

Where these changes come from, who merged them and whether we can fix something in your library.

Using Monolog in your project?

If something in it does not work, we fix it at the source and leave a workaround until the release. We reply within an hour.