If someone (i.e. @twitter or @github) added an entry to filter from the log, would that overwrite the default — and thus expose passwords to the log? http://guides.rubyonrails.org/action_controller_overview.html#parameters-filtering