Bug Description

Sensitive authentication data may be exposed in extension console logs during normal usage.
When generating reports, debug/storage logs can include token-related values, creating a security risk if logs are shared or collected.

Steps to Reproduce

1. Open Scrum Helper in browser developer mode.
2. Open extension popup and enter a valid GitHub personal access token.
3. Click Generate to fetch activity.
4. Open DevTools for the extension (popup/service worker/content script console).
5. Observe verbose log output containing storage/debug data that may reveal sensitive auth information.

Expected Behavior

• Tokens and authorization values should never be printed in logs.
• Logs should be sanitized/redacted in all extension contexts.
• Production behavior should avoid verbose debug output by default.

Actual Behavior

• Verbose runtime logs are emitted in production paths.
• Storage/debug logs may include sensitive token-related fields.
• This can leak credentials through screenshots, shared logs, or enterprise log collectors.

Additional Context

• Severity: Security / Privacy
• Impact: Potential credential exposure and unauthorized API use if token is leaked
• Suggested fix:

1. Add centralized log sanitization (redact keys like githubToken, gitlabToken, authorization).
2. Gate debug logs behind a disabled-by-default flag.
3. Remove raw storage object logging from production code paths.
4. Add regression checks to ensure secrets never appear in console output.

Contribution Checklist

• I have searched existing issues to ensure this bug hasn't been reported
• I have provided clear reproduction steps
• I have included relevant environment details
• I have described both expected and actual behavior