Or, rather, simply never commit code that logs authentication credentials, in production or otherwise.