Traefik access log drops the request path, where a hook's secret sits

docker/compose.dev.yml

@@ -33,6 +33,7 @@ services:
       - --entrypoints.https.address=:443
       - --accesslog
       - --accesslog.fields.queryparameters.defaultmode=drop
+      - --accesslog.fields.names.RequestPath=drop
       - --log
       - --log.level=DEBUG
       - --api

docker/compose.traefik.yml

@@ -71,6 +71,10 @@ services:
       # Without query strings: the live socket and a worker's attach carry their
       # token there, and Traefik can drop query values but not mask them
       - --accesslog.fields.queryparameters.defaultmode=drop
+      # Nor the request path: a webhook's secret is its last segment, and the
+      # path can be dropped but not masked in part. The engine's own request
+      # log keeps the path, with the secret masked.
+      - --accesslog.fields.names.RequestPath=drop
       # Enable the Traefik log, for configurations and errors
       - --log
       # Enable the Dashboard and API