Well, maybe I've succumbed -- belatedly -- to the reality distortion field.
But damned if I'd let a product ship while it was logging passwords.
Simple QA is to scan log files for anything that shouldn't be there. It requires no more than defining those values, pattern matching, and patience while it churns.
This is actually a testing pattern that fits well into automation. As opposed to a lot of the "how do we hook into the GUI, so we can click stuff" automated QA I've seen.
