Great read.

> And while people will write the code that accidentally introduces sensitive data into logs, they’re also the ones that will report, respond, and fix them.

This should probably be the first point and not the last.