Sanitizing sensitive data with serilog

out.txt

{"Timestamp":"2020-01-13T18:44:30.6184881+01:00","Level":"Information","MessageTemplate":"This is a test object {@TestObject}","Properties":{"TestObject":{"SensitiveData":"*** PII ***","NormalData":"Normal","SubObject":{"SecurePassword":"*** PII ***"}}}}

Program.cs

using System;
using System.Collections.Generic;
using System.Reflection;
using Serilog;
using Serilog.Core;
using Serilog.Events;
using Serilog.Formatting.Json;

namespace SerilogSanitizer
{
    class Program
    {
        static void Main(string[] args)
        {
            var config = new LoggerConfiguration()
                .Destructure.With<MyDestructPolicy>()
                .WriteTo.Console(new JsonFormatter());

            var logger = config.CreateLogger();

            var data = new TestObject
            {
                NormalData = "Normal",
                SensitiveData = "super secure data",
                SubObject = new TestSubObject
                {
                    SecurePassword = "123456"
                }
            };
            logger.Information("This is a test object {@TestObject}", data);
        }
    }

    internal class MyDestructPolicy : IDestructuringPolicy
    {
        public bool TryDestructure(object value, ILogEventPropertyValueFactory propertyValueFactory, out LogEventPropertyValue result)
        {
            var type = value.GetType();

            var resultValues = new Dictionary<ScalarValue, LogEventPropertyValue>();
            
            foreach (var propertyInfo in type.GetProperties(BindingFlags.Public | BindingFlags.GetProperty | BindingFlags.Instance))
            {
                var name = propertyInfo.Name;

                var isSensitiveData = propertyInfo.GetCustomAttribute<SensitiveDataAttribute>() != null;

                var propertyValue = isSensitiveData ? "*** PII ***" : propertyInfo.GetValue(value);
                resultValues.Add(new ScalarValue(name), propertyValueFactory.CreatePropertyValue(propertyValue, true));
            }

            result = new DictionaryValue(resultValues);
            return true;
        }
    }

    class TestObject
    {
        [SensitiveData]
        public string SensitiveData { get; set; }
        public string NormalData { get; set; }

        public TestSubObject SubObject { get; set; }
    }

    class TestSubObject
    {
        [SensitiveData]
        public string SecurePassword { get; set; }
    }

    [AttributeUsage(AttributeTargets.Property)]
    class SensitiveDataAttribute : Attribute
    {
    }
}

SerilogSanitizer.csproj

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>netcoreapp3.1</TargetFramework>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Serilog" Version="2.9.0" />
    <PackageReference Include="Serilog.Sinks.Console" Version="3.1.1" />
  </ItemGroup>

</Project>