A production handler logs complete HTTP headers, request payloads, and database credentials during debugging. Which changes reduce credential exposure while retaining useful diagnostics? Select 2 answers.

1. Redact or omit credentials and sensitive payload fields before they enter logs.
2. Keep full secrets in logs because the function role is trusted.
3. Base64-encode secrets and treat the encoded text as safely anonymized.
4. Return all log records to unauthenticated users for troubleshooting.
5. Restrict diagnostic access and apply appropriate log retention and encryption controls.