python false positive Clear-text logging of sensitive information

**Description of the false positive**

I have a python aws lambda that returns a json payload with correctly identified sensitive information (along with metadata like status code, etc.). I have a 'log response' function that specifically logs metadata and no sensitive data, but codeql is reporting that sensitive non-metadata fields are being logged.

**Code samples or links to source code**

```python
def main():
user_creds = ... // sensitive information here
return write_access_log({
"statusCode": 200,
"body": {
"dry_run": False,
# actual sensitive information here
"credentials": {
"db": {
"username": user_creds.username,
"privatekey": user_creds.encrypted_private_key,
"passphrase": user_creds.private_key_passphrase,
}
}
}
})

def write_access_log(resp):
if "statusCode" in resp:
dry_run = (
str(resp["body"]["dry_run"])
if resp.get("body", {}).get("dry_run") is not None
else "unknown"
)
payload = {"statusCode": int(resp["statusCode"]), "dry_run": dry_run}
msg = json.dumps(payload)
# Flagged as 'clear-text logging of sensitive information', showing a path that includes
# "passphrase" from resp which is not logged
logger.info(msg)

return resp
```

Start with the Python clear-text logging query and the shown write_access_log/logger.info path. Compare the reported path through resp with the fields actually included in payload, then validate that the example no longer produces a finding while genuine sensitive logging remains detected.

Escrito por el modelo de indexación a partir del texto del issue.