Filter out sensitive info before it ends up in ELMAH

ElmahSensitiveDataFilter.cs

public static class ElmahSensitiveDataFilter
{
    public static void Apply(ExceptionFilterEventArgs e, HttpContext ctx)
    {
        var sensitiveFormData = ctx.Request.Form.AllKeys.GetSensitiveFormData();
        if (sensitiveFormData.Count == 0)
        {
            return;
        }
        var error = new Error(e.Exception, ctx);
        sensitiveFormData.ForEach(k => error.Form.Set(k, "*****"));
        //we don't want to log the unmodified http context stuff so use the null context.
        ErrorLog.GetDefault(null).Log(error);
        e.Dismiss();
    }

    public static List<string> GetSensitiveFormData(this string[] formKeys)
    {
        return formKeys.Where(key => key.EndsWith("password", StringComparison.OrdinalIgnoreCase)).ToList();
    }
}

Global.asax.cs

//In Global.asax.cs

 protected void ErrorLog_Filtering(object sender, ExceptionFilterEventArgs e)
 {
    var ctx = e.Context as HttpContext;
    if (ctx == null)
    {
        return;
    }
    ElmahSensitiveDataFilter.Apply(e, ctx);
}