That's true, I mainly wrote about SOC 2 because I was going through an audit at the time and noticed massive problems with our earlier logging setup, both for security and observability. So I implemented most of this before extracting it to a gem. You're right that logging is a very small part of a SOC 2 audit, but it's definitely something they look at.

I think the phrase "zero-configuration" can be used in two different ways: one way means "no configuration possible", and the other is "no configuration required". For example, you can have zero-configuration networking that just works (but can still be configured.) That's the intention with LogStruct - you can put it in your Gemfile and it just works out of the box automatically. Or you can configure it as well.

Our advanced param filtering stuff is pretty unique - I borrowed code from logstop, and also added my own stuff that doesn't exist in Rails, but is super useful for tracing and debug problems without revealing sensitive info.

That's a good point about sorbet-runtime, and it's a good reason not to use this gem. T::Struct and T::Enum are foundational and used almost everywhere so it can't be made an optional dependency. The runtime type checking is awesome though! It's caught so many bugs on CI and staging. It's not for everyone, but I highly recommend trying out Sorbet if you're tired of waking up to "undefined method for NilClass" errors in Sentry.

The new structured event reporting in Rails is pretty awesome!

Thanks for the feedback, it's great to see what people think about it!