Document that exceptions must not be interpolated into log messages

Exception messages can contain sensitive data, and text interpolated
into a log string cannot be filtered or redacted by logging handlers.
Record the rule in the agent conventions and the code quality docs:
log a static message and pass the exception via exc_info instead.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: rtibbles

AGENTS.md

@@ -132,7 +132,7 @@ kolibri/
 
 ## Key Conventions
 
-**Python:** F-strings preferred. One import per line. `DateTimeTzField` for timestamps (not Django's `DateTimeField`). `UUIDField` from morango for syncable models. Descriptive migration names (no `_auto_`). All imports at file top — inline imports are only permitted to prevent circular imports.
+**Python:** F-strings preferred. One import per line. `DateTimeTzField` for timestamps (not Django's `DateTimeField`). `UUIDField` from morango for syncable models. Descriptive migration names (no `_auto_`). All imports at file top — inline imports are only permitted to prevent circular imports. Never interpolate exception messages into log strings (security risk — they can contain sensitive data); log a static message and pass `exc_info=True`.
 
 **Vue:** PascalCase filenames. Component `name` must match filename. Use `computed()` for derived values.
 

docs/code_quality.rst

@@ -93,6 +93,8 @@ If something that "cannot happen" happens, crash — a dead program does less da
 
 In Kolibri, Django REST Framework's exception handling will catch unhandled exceptions and return appropriate error responses — there is no need to wrap every view method in a try/except.
 
+When you do catch and log an exception, never interpolate the exception message into the log string (``logger.error(f"Failed: {e}")``) — exception messages can contain sensitive data such as credentials, tokens, or personal information, and text baked into the message cannot be filtered or redacted by logging handlers. Log a static message and pass the exception via ``logger.error("Failed to save report.", exc_info=True)`` so it flows through the logging framework.
+
 
 Tell, don't ask
 ---------------