Heroku's router logs sensitive query strings (no mitigation yet)

[eliotsykes]

Heroku's router writes query strings, including any secrets they may contain, to the log.

Here's an example, where it has written reset_password_token=SECRET-TOKEN to the log:

06 Aug 2020 01:10:10.100000 <158>1 2020-08-06T00:10:10.000009+00:00
  heroku router - - at=info method=GET
  path="/password/edit?reset_password_token=SECRET-TOKEN"

Question asked here for mitigation: https://stackoverflow.com/questions/63399242/how-to-scrub-sensitive-query-strings-from-herokus-router-logs

[eliotsykes]

Related mitigation for Devise - expiring password reset tokens on first GET request: heartcombo/devise#5281