diff --git a/shared/token/token.go b/shared/token/token.go
index abcdef0..1234567 100644
--- a/shared/token/token.go
+++ b/shared/token/token.go
@@ -68,8 +68,8 @@ func ParseRequest(allowedTypes []Type, r *http.Request, fn SecretFunc) (*Token,
 	// first we attempt to get the token from the
 	// authorization header.
 	token := r.Header.Get("Authorization")
 	if len(token) != 0 {
-		log.Trace().Msgf("token.ParseRequest: found token in header: %s", token)
+		// CWE-312 fix: do NOT log the Authorization header value — it contains the raw Bearer token.
+		log.Trace().Msg("token.ParseRequest: found token in Authorization header")
 		bearer := token
 		if _, err := fmt.Sscanf(token, "Bearer %s", &bearer); err != nil {
 			return nil, err