[buongarzoni]

Description of the change

Payload.toString() printed the access token in plain text, and RollbarBase logs the payload at
DEBUG on every event (LOGGER.debug("Payload built: {}", payload)). Turning on DEBUG logging, which
people often do while debugging an incident, wrote the token to log files and any log shipper.

toString() now masks the token and keeps only its last 4 characters, so you can still tell which
token is configured:

Before: Payload{accessToken='fake0000000000000000000000secret', data=...}
After:  Payload{accessToken='****cret', data=...}

Tokens of 8 characters or fewer are fully masked ('****'). A null token still prints null.
Serialization (asJson()) is unchanged, so the token is still sent to the API.

After changes

Type of change

• Bug fix (non-breaking change that fixes an issue)

Checklists

Development

• Lint rules pass locally (checkstyleMain)
• The code changed/added as part of this pull request has been covered with tests
• All tests related to the changed code pass in development (PayloadTest)

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-13T06:17:05.482413Z	e96202b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.