chore: remove PII from logs

Signed-off-by: Frank Kong <frkong@redhat.com>

.changeset/funny-tips-push.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+update the `morgan` middleware to use a custom format to prevent PII from being logged

.github/vale/config/vocabularies/Backstage/accept.txt

@@ -243,6 +243,7 @@ Mkdocs
 monorepo
 Monorepo
 monorepos
+morgan
 msgraph
 msw
 mutex

packages/backend-defaults/src/entrypoints/rootHttpRouter/http/MiddlewareFactory.ts

@@ -140,8 +140,9 @@ export class MiddlewareFactory {
     const logger = this.#logger.child({
       type: 'incomingRequest',
     });
-
-    return morgan('combined', {
+    const customMorganFormat =
+      '[:date[clf]] ":method :url HTTP/:http-version" :status :res[content-length] ":referrer" ":user-agent"';
+    return morgan(customMorganFormat, {
       stream: {
         write(message: string) {
           logger.info(message.trimEnd());