[Security] Keep replicated row identifiers and parser diagnostics out of CDC logs

[seonghobae]

Buyer / confidentiality gap

Protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 logs raw CDC row identifiers and exception stack traces in ProcessedDataReplicaApplier on malformed or incomplete replica events. The replication path needs finite operational classification, not per-row business identifiers or parser/driver diagnostics in ordinary logs.

Current protected behavior includes:

• Replica apply failed: missing data field (topic={}, id={});
• Replica apply failed: data is null (topic={}, id={});
• IllegalStateException messages containing id=...;
• malformed Debezium value/key parsing logged with the complete caught exception object.

Row IDs can be customer/business identifiers and are high-cardinality. Exception diagnostics can contain input/location/provider details. This is distinct from #170 (replication-slot diagnostics), #171 (raw replicated DDL), and #172 (CDC stop API response).

RCA

• Immediate cause: operational failure paths interpolate id and pass exception objects to SLF4J.
• Technical root cause: replication correctness errors and parser diagnostics are modeled as raw event/debug transport rather than stable failure classes.
• Control failure: tests assert functional failure/skip semantics but do not assert that raw row IDs and parser diagnostics stay out of logs.

Bounded remediation

Use TDD on the real ProcessedDataReplicaApplier logging boundary. Preserve JDBC execution and fail/skip semantics, but:

1. log stable finite messages without raw row ID, raw key/value JSON, SQL, or exception text;
2. preserve enough classification to distinguish missing data, null data, malformed value JSON, and malformed key fallback;
3. do not add regex-based masking as the primary control;
4. keep business payload available to the replication computation itself — this is log minimization, not blanket PII masking;
5. add beginner-readable public Javadoc for touched public behavior if missing.

Acceptance

• fail-first log-capture tests prove protected code emits a realistic numeric identifier and parser diagnostic;
• production repair leaves JDBC-bound id/data semantics unchanged;
• success, delete, missing-data, null-data, malformed-value, and malformed-key paths remain behaviorally correct;
• ordinary logs contain no raw row ID, key/value JSON, parser message, JDBC/URL/credential-like diagnostic, SQL, or exception stack trace from these paths;
• focused/full CDC tests and current dependency/SBOM/SAST/security gates pass;
• canonical Security/Threat Model/Test Strategy/Operability/Traceability later records this diagnostic-confidentiality boundary as active_pr until protected integration;
• synthetic-merge-only execution is compatibility evidence, not literal-source proof.

No change to CDC acknowledgement (#139), graceful stop (#141), DDL application semantics (#171), or external masking policy is in scope.