# UNDF: UNDF-2026-000001163
--- a/src/clients/FtpGateway.cc
+++ b/src/clients/FtpGateway.cc
@@ -399,13 +399,13 @@ void
 Ftp::Gateway::loginParser(const SBuf &login, bool escaped)
 {
     debugs(9, 4, "login=" << login << ", escaped=" << escaped);
-    debugs(9, 9, "IN : login=" << login << ", escaped=" << escaped << ", user=" << user << ", password=" << password);
+    debugs(9, 9, "IN : login=[REDACTED], escaped=" << escaped << ", user=[user], password=[REDACTED]");

     if (login.isEmpty())
         return;

     if (!login[0]) {
         debugs(9, 2, "WARNING: Ignoring FTP credentials that start with a NUL character");
         return;
     }

@@ -427,13 +427,13 @@ Ftp::Gateway::loginParser(const SBuf &login, bool escaped)
         if (escaped)
             rfc1738_unescape(user);
-        debugs(9, 9, "found user=" << user << " (" << strlen(user) << ") unescaped.");
+        debugs(9, 9, "found user (length " << strlen(user) << ") unescaped.");
     }

     if (colonPos != SBuf::npos) {
         const SBuf pass = login.substr(colonPos+1, SBuf::npos);
         SBuf::size_type upto = pass.copy(password, sizeof(password)-1);
         password[upto]='\0';
-        debugs(9, 9, "found password=" << pass << " " <<
-               (upto != pass.length() ? ", truncated-to=" : ", length=") << upto <<
-               ", escaped=" << escaped);
+        debugs(9, 9, "found password (length=" << pass.length() << ", truncated=" <<
+               (upto != pass.length() ? "yes" : "no") << ", escaped=" << escaped << ")");
         if (escaped) {
             rfc1738_unescape(password);
             password_url = 1;
         }
-        debugs(9, 9, "found password=" << password << " (" << strlen(password) << ") unescaped.");
+        debugs(9, 9, "found password (unescaped length=" << strlen(password) << ")");
     }

-    debugs(9, 9, "OUT: login=" << login << ", escaped=" << escaped << ", user=" << user << ", password=" << password);
+    debugs(9, 9, "OUT: login=[REDACTED], escaped=" << escaped);
 }

--- a/src/auth/basic/Config.cc
+++ b/src/auth/basic/Config.cc
@@ -184,10 +184,10 @@ Auth::Basic::Config::decodeCleartext(const char *httpAuthHeader, const HttpReque
         /*
          * Don't allow NL or CR in the credentials.
          */
-        debugs(29, 9, "'" << cleartext << "'");
+        debugs(29, 9, "decoded basic credentials (length " << strlen(cleartext) << ")");

         if (strcspn(cleartext, "\r\n") != strlen(cleartext)) {
-            debugs(29, DBG_IMPORTANT, "WARNING: Bad characters in authorization header '" << httpAuthHeader << "'");
+            debugs(29, DBG_IMPORTANT, "WARNING: Bad characters in Basic authorization header (base64 header suppressed for security)");
             safe_free(cleartext);
         }
     } else {
-        debugs(29, 2, "WARNING: Invalid Base64 character in authorization header '" << httpAuthHeader << "'");
+        debugs(29, 2, "WARNING: Invalid Base64 character in Basic authorization header (base64 header suppressed for security)");
         safe_free(cleartext);
     }

--- a/src/auth/basic/UserRequest.cc
+++ b/src/auth/basic/UserRequest.cc
@@ -102,7 +102,7 @@ Auth::Basic::UserRequest::startHelperLookup(HttpRequest *request, AccessLogEntry
     assert(basic_auth != nullptr);
-    debugs(29, 9, "'" << basic_auth->username() << ":" << basic_auth->passwd << "'");
+    debugs(29, 9, "looking up basic auth user '" << basic_auth->username() << "' (password suppressed)");