Don't log things to the debug log that might contain access_tokens or refresh_tokens for the user, as they give (limited) access to their account.