diff --git a/pkg/apigateway/handler/oidc.go b/pkg/apigateway/handler/oidc.go
index e9963e60cf..6e2e61886a 100644
--- a/pkg/apigateway/handler/oidc.go
+++ b/pkg/apigateway/handler/oidc.go
@@ -33,6 +33,7 @@ import (
 	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/httputils"
 	"yunion.io/x/pkg/util/netutils"
+	"yunion.io/x/pkg/utils"
 
 	"yunion.io/x/onecloud/pkg/apigateway/clientman"
 	"yunion.io/x/onecloud/pkg/apigateway/options"
@@ -396,7 +397,7 @@ func handleOIDCUserInfo(ctx context.Context, w http.ResponseWriter, req *http.Re
 	}
 	token, err := decodeOIDCClientToken(tokenHdr)
 	if err != nil {
-		log.Errorf("decodeOIDCClientToken %s fail %s", tokenHdr, err)
+		log.Errorf("decodeOIDCClientToken %s fail %s", utils.TruncateString(tokenHdr, 16), err)
 		httperrors.InvalidCredentialError(ctx, w, "Token in header invalid")
 		return
 	}
diff --git a/pkg/cloudcommon/policy/policy.go b/pkg/cloudcommon/policy/policy.go
index 632ef1c938..9707e61a93 100644
--- a/pkg/cloudcommon/policy/policy.go
+++ b/pkg/cloudcommon/policy/policy.go
@@ -28,6 +28,7 @@ import (
 	"yunion.io/x/pkg/gotypes"
 	"yunion.io/x/pkg/util/netutils"
 	"yunion.io/x/pkg/util/rbacscope"
+	"yunion.io/x/pkg/utils"
 
 	"yunion.io/x/onecloud/pkg/apis"
 	identity_api "yunion.io/x/onecloud/pkg/apis/identity"
@@ -334,7 +335,7 @@ func (manager *SPolicyManager) allowWithoutCache(policies rbacutils.TPolicySet,
 			user = userCred.GetUserName()
 			token = userCred.GetTokenString()
 		}
-		log.Warningf("no policies fetched for scope %s user %s token %s key %s", scope, user, token, policyKey(userCred))
+		log.Warningf("no policies fetched for scope %s user %s token %s key %s", scope, user, utils.TruncateString(token, 16), policyKey(userCred))
 	} else {
 		matchRules = policies.GetMatchRules(service, resource, action, extra...)
 		if consts.IsRbacDebug() {
diff --git a/pkg/hostman/diskutils/nbdkit.go b/pkg/hostman/diskutils/nbdkit.go
index 101048df1d..2bc78517a3 100644
--- a/pkg/hostman/diskutils/nbdkit.go
+++ b/pkg/hostman/diskutils/nbdkit.go
@@ -152,7 +152,9 @@ func (vd *NbdkitDisk) ExecProg() error {
 		args = append(args, fmt.Sprintf("password=%s", vd.Passwd))
 	}
 	cmd := NewCommand("nbdkit", args...)
-	log.Debugf("command to mount: %s", cmd)
+	// mask the password in the log, do not print it verbatim
+	safeCmd := strings.Replace(cmd.String(), "password="+vd.Passwd, "password=******", 1)
+	log.Debugf("command to mount: %s", safeCmd)
 	vd.Proc = cmd
 	vd.NbdURI = ""
 	err := vd.Proc.Start()
diff --git a/pkg/hostman/guestfs/fsdriver/linux.go b/pkg/hostman/guestfs/fsdriver/linux.go
index cb85b167f2..e8a4718523 100644
--- a/pkg/hostman/guestfs/fsdriver/linux.go
+++ b/pkg/hostman/guestfs/fsdriver/linux.go
@@ -234,10 +234,10 @@ func (l *sLinuxRootFs) checkInputPasswd(rootFs IDiskPartition, config *pwquality
 
 	err := config.Validate(password, account)
 	if err != nil && errors.Cause(err) == pwquality.ErrPasswordTooWeak {
-		log.Infof("password %s too weak, try regenerate password", password)
+		log.Infof("password too weak, try regenerate password")
 		npassword := config.GeneratePassword(seclib2.RandomPassword2)
 		if len(npassword) > 0 {
-			log.Infof("regenerate password %s", npassword)
+			log.Infof("regenerate password (not logged)")
 			password = npassword
 		}
 	}
diff --git a/pkg/llm/models/mcp_agent.go b/pkg/llm/models/mcp_agent.go
index 6a50ae4331..685e0022db 100644
--- a/pkg/llm/models/mcp_agent.go
+++ b/pkg/llm/models/mcp_agent.go
@@ -857,7 +857,7 @@ func processToolCalls(
 			arguments = make(map[string]interface{})
 		}
 
-		log.Infof("Calling tool: %s with arguments: %v", toolName, arguments)
+		log.Infof("Calling tool: %s", toolName)
 
 		// 独立超时 + WithoutCancel：避免父请求短 deadline（如 60s）掐断公有云 create 等待
 		toolCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), mcpToolCallTimeout())
diff --git a/pkg/llm/utils/mcp_client.go b/pkg/llm/utils/mcp_client.go
index 16929bcbee..63a9199bfc 100644
--- a/pkg/llm/utils/mcp_client.go
+++ b/pkg/llm/utils/mcp_client.go
@@ -334,7 +334,9 @@ func (c *MCPClient) sendRequest(ctx context.Context, req mcp.JSONRPCRequest) (*r
 	}
 
 	reqBody := jsonutils.Marshal(req)
-	log.Infof("MCP request: %s", reqBody.String())
+	// log the method only, tool parameters may contain sensitive data
+	method, _ := reqBody.GetString("method")
+	log.Infof("MCP request: %s", method)
 
 	cli := auth.Client()
 	if cli == nil {
diff --git a/pkg/mcclient/auth/auth.go b/pkg/mcclient/auth/auth.go
index 47fc18ffa6..ac31faeac6 100644
--- a/pkg/mcclient/auth/auth.go
+++ b/pkg/mcclient/auth/auth.go
@@ -28,6 +28,7 @@ import (
 	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/cache"
 	"yunion.io/x/pkg/util/httputils"
+	"yunion.io/x/pkg/utils"
 
 	"yunion.io/x/onecloud/pkg/apis/identity"
 	"yunion.io/x/onecloud/pkg/cloudcommon/syncman"
@@ -123,7 +124,7 @@ func (c *TokenCacheVerify) Verify(ctx context.Context, cli *mcclient.Client, adm
 			return cred, nil
 		} else {
 			c.DeleteToken(token)
-			log.Infof("Remove expired cache token: %s", token)
+			log.Infof("Remove expired cache token: %s", utils.TruncateString(token, 16))
 		}
 	}
 
diff --git a/pkg/webconsole/session/session.go b/pkg/webconsole/session/session.go
index c539651f3e..faeff58413 100644
--- a/pkg/webconsole/session/session.go
+++ b/pkg/webconsole/session/session.go
@@ -93,7 +93,7 @@ func (man *SSessionManager) Get(accessToken string) (*SSession, bool) {
 	protocol := s.GetProtocol()
 	if protocol != SPICE && time.Since(s.AccessedAt) < AccessInterval {
 		if !(protocol == WS && o.Options.KeepWebsocketSession) {
-			log.Warningf("Protol: %q, Token: %s, Session: %s can't be accessed during %s, last accessed at: %s", s.GetProtocol(), accessToken, s.Id, AccessInterval, s.AccessedAt)
+			log.Warningf("Protol: %q, Token: %s, Session: %s can't be accessed during %s, last accessed at: %s", s.GetProtocol(), utils.TruncateString(accessToken, 16), s.Id, AccessInterval, s.AccessedAt)
 			return nil, false
 		}
 	}