SpecialAccountRecovery::sendConfirmationEmail() logs the full 32-character hex confirmation token in plaintext:

$this->logger->info(
  'Account recovery request submitted for {username}',
  [
	  'username' => $ticketData['requester_name'],
	  'email' => $ticketData['requester_email'],
	  'token' => $token,   // full 32-char hex token
  ]
);

This token is the sole secret protecting the account recovery confirmation link (Special:AccountRecovery/confirm/{token}`). If logs are compromised or accessible to a wider audience than intended, an attacker could use the
token to submit Zendesk recovery tickets on behalf of users.

The auth provider already follows the correct pattern for its 6-digit verification code, logging only the first two characters:

'code' => substr( $token, 0, 2 ) . '...',

Recommendation: Apply the same redaction pattern to the recovery token:

'token' => substr( $token, 0, 4 ) . '...',

(4 characters is reasonable for a 32-char hex token ? enough to correlate log entries during debugging without exposing a usable secret.)