Avoid saving $_POST in Craft logs for certain URLs
As Oli commented, those will only be logged if devMode is enabled, which should never be the case in production.

Outside of that, Craft does have a sensitiveKeywords propery in the Security class: https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29 that defaults to these keywords: https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29 and will redact those from places like log files.

If you need to modify that list, you can do so from by extending the application config like so:

&lt;?php
return [
    'components' =&gt; [
        'security' =&gt; [
            'class' =&gt; craft\services\Security::class,
            'sensitiveKeywords' =&gt; [
                'key1',
                'key2',
            ],
        ],
    ],
];