Earlier quoted context omitted.
There are a finite number of log locations now . How do you intend to operate an integration test across the entirety of Facebook's stack to detect new log locations?
Change requests and a change review board staffed by professionals. Subject: Change Request Body: I would like to log the body of authentication requests in production. Subject Re: Change Request Body: How will you ensure personal data is not stored that shouldn't be? Subject: Re: Re: Change Request Body: I will add configuration Y to logging system X.
Reviewer: Does this have privacy implications?
Change1: No, Service X marks all PII before this point. Code X drops everything marked in this way.
Two years later.
Change N: Modify request structure for more optimal blah blah blah.
Now suddenly the changed request structure causes a regression in the PII detection which causes some logging of PII.
This shit is way more complex than "just stop people when they ask to log passwords".