FYI - accidentally logging secrets is a fairly common thing that happens. Request/response bodies are fairly common place that would include secrets or PII. but in general you’d be surprised what other actually innocent places that end up accidentally including secrets. Having credential scanners on the logs is a way to catch these early.

As for sophisticated attackers, I think that phrase should probably be retired at this point. Every attacker is a fairly sophisticated now since you can automate that sophistication. Attackers before used to have a set of tools that would try to connect or execute a bunch of automated prescripted checks, while any attacker now can automate the generation of those tools and scripts on demand