Order failure informationis appropriate operational data for diagnostic logging when it is implemented without exposing protected shopper information. Checkout failures, error codes, integration outcomes, or non-sensitive order-processing context can provide developers and support teams with the information needed to diagnose failed purchases.
Passwords must never be written to application logs. Likewise, complete credit-card information is sensitive payment data subject to stringent PCI controls and should not be placed into custom log files. Salesforce specifically warns developers to filter sensitive or private data—such as credit-card numbers—from service logs, and B2C Commerce payment APIs treat cardholder and financial information as PCI-sensitive data.
Option B would create an obvious credential-disclosure risk because anyone with log access could potentially recover customer authentication data. Option C would unnecessarily persist cardholder information outside the platform ' s protected payment-data handling mechanisms.
The proper logging strategy captures enough contextual data to diagnose checkout problems while excluding passwords, full payment credentials, authentication secrets, and similar sensitive values.
Study Guide reference:Application Development — secure logging, checkout diagnostics, PCI considerations, payment data handling, and protection of customer credentials.
===============
