Query String Redaction

Change effective on 14 April 2026

You can now redact sensitive query string parameters from your external log drains using the http-router-no-log-query feature flag. Once enabled, the Heroku Router will automatically strip query strings from incoming URLs and replace them with a REDACTED label (e.g., /foo/bar?REDACTED).

To opt-in using the Heroku CLI:

$ heroku features:enable http-router-no-log-query -a <your-app-name>

This feature is fully supported across the Common Runtime and Private Spaces. See the HTTP Routing docs for more info.