Write a method that redacts sensitive fields from structured log properties.

Implement Redact(IDictionary<string, string?>? properties, ISet<string>? sensitiveKeys) returning a new dictionary. Sensitive keys are matched case-insensitively and their values become [REDACTED].

Input: { Email: "a@b.com", Password: "secret" }, sensitive key password Output: { Email: "a@b.com", Password: "[REDACTED]" }

• Do not mutate the input dictionary.
• Sensitive key matching is case-insensitive.
• Null input returns an empty dictionary.
• Null values are allowed and preserved unless the key is sensitive.

I would build a result dictionary and copy each property. To match sensitive keys case-insensitively, I would create a HashSet<string> with StringComparer.OrdinalIgnoreCase. If the key is sensitive, I store [REDACTED]; otherwise I store the original value. I would mention that allow-list logging is even safer for highly sensitive systems, but this exercise asks for key-based redaction.

public static IReadOnlyDictionary<string, string?> Redact(
    IDictionary<string, string?>? properties,
    ISet<string>? sensitiveKeys)
{
    var result = new Dictionary<string, string?>(StringComparer.Ordinal);
    if (properties is null)
    {
        return result;
    }

    var sensitive = new HashSet<string>(
        sensitiveKeys ?? new HashSet<string>(),
        StringComparer.OrdinalIgnoreCase);

    foreach (var pair in properties)
    {
        result[pair.Key] = sensitive.Contains(pair.Key)
            ? "[REDACTED]"
            : pair.Value;
    }

    return result;
}

The method is O(n + s), where n is the number of properties and s is the number of sensitive keys. Space is O(n + s) for the result and lookup set.

• Null properties.
• Null sensitive key set.
• Sensitive key with different casing.
• Null property value.
• Input dictionary should remain unchanged.

• Use Password, password, and PASSWORD.
• Check that the original dictionary still contains the original values.
• Use non-sensitive personal data and decide whether policy should redact it too.

• Mutating input unexpectedly.
• Case-sensitive sensitive-key matching.
• Redacting by substring and damaging safe fields.
• Logging raw secrets before redaction happens.