Not logging them specifically at all, just in general logs he's not sanitizing them. He basically said no one else should be able to see the logs, but i'm of the opinion i should never see our user's passwords. I've left multiple websites when they sent me an email with my plaintext password