diff --git a/lib/middleware.js b/lib/middleware.js
index e570b4ce..74df973c 100644
--- a/lib/middleware.js
+++ b/lib/middleware.js
@@ -137,7 +137,9 @@ module.exports = function(srf, logger) {
       const obj = Object.assign({}, app);
       delete obj.requestor;
       delete obj.notifier;
-      logger.info({app: obj}, `retrieved application for incoming call to ${req.locals.calledNumber}`);
+      // eslint-disable-next-line no-unused-vars
+      const {call_hook, call_status_hook, ...appInfo} = obj;  // mask sensitive data like user/pass on webhook
+      logger.info({app: appInfo}, `retrieved application for incoming call to ${req.locals.calledNumber}`);
       req.locals.callInfo = new CallInfo({req, app, direction: CallDirection.Inbound});
       next();
     } catch (err) {
diff --git a/lib/tasks/say.js b/lib/tasks/say.js
index e282eb27..1e7d9c93 100644
--- a/lib/tasks/say.js
+++ b/lib/tasks/say.js
@@ -33,7 +33,7 @@ class TaskSay extends Task {
     const salt = cs.callSid;
     const credentials = cs.getSpeechCredentials(vendor, 'tts');
 
-    this.logger.info({vendor, credentials}, 'Task:say - using vendor');
+    this.logger.info(`Task:say - using vendor: ${vendor}`);
     this.ep = ep;
     try {
       if (!credentials) {
diff --git a/lib/utils/requestor.js b/lib/utils/requestor.js
index a2863073..72765412 100644
--- a/lib/utils/requestor.js
+++ b/lib/utils/requestor.js
@@ -100,15 +100,15 @@ class Requestor {
 
     assert.ok(url, 'Requestor:request url was not provided');
     assert.ok, (['GET', 'POST'].includes(method), `Requestor:request method must be 'GET' or 'POST' not ${method}`);
-
-    this.logger.debug({hook, payload}, `Requestor:request ${method} ${url}`);
+    const {url: urlInfo = hook, method: methodInfo = 'POST'} = hook;  // mask user/pass
+    this.logger.debug({url: urlInfo, method: methodInfo, payload}, `Requestor:request ${method} ${url}`);
     const startAt = process.hrtime();
 
     let buf;
     try {
       const sigHeader = generateSigHeader(payload, this.secret);
       const headers = {...sigHeader, ...this.authHeader};
-      this.logger.info({url, headers}, 'send webhook');
+      //this.logger.info({url, headers}, 'send webhook');
       buf = isRelativeUrl(url) ?
         await this.post(url, payload, headers) :
         await bent(method, 'buffer', 200, 201, 202)(url, payload, headers);
diff --git a/package-lock.json b/package-lock.json
index f2b83938..8801e39f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,7 +8,7 @@
       "version": "0.6.7-rc5",
       "license": "MIT",
       "dependencies": {
-        "@jambonz/db-helpers": "^0.6.13",
+        "@jambonz/db-helpers": "^0.6.14",
         "@jambonz/mw-registrar": "^0.2.1",
         "@jambonz/realtimedb-helpers": "^0.4.8",
         "@jambonz/stats-collector": "^0.1.5",
@@ -376,9 +376,9 @@
       }
     },
     "node_modules/@jambonz/db-helpers": {
-      "version": "0.6.13",
-      "resolved": "https://registry.npmjs.org/@jambonz/db-helpers/-/db-helpers-0.6.13.tgz",
-      "integrity": "sha512-7VXb1q8Jii76XFYMyIjsLr33w5s1DFUN1fjtU+r5PpZQuM7YXhVHfOW3q0652RMrEP2vqW2h6cpBNclvLPJzjg==",
+      "version": "0.6.14",
+      "resolved": "https://registry.npmjs.org/@jambonz/db-helpers/-/db-helpers-0.6.14.tgz",
+      "integrity": "sha512-dWUjDb2If9NwUpUxlAJ4PbIWRyA1gZTkmiICix/f76yAF5aGCf0hgOiYXlh335BRYsX5By41yS7DkLXaTxbx9g==",
       "dependencies": {
         "cidr-matcher": "^2.1.1",
         "debug": "^4.3.1",
@@ -5187,9 +5187,9 @@
       "dev": true
     },
     "@jambonz/db-helpers": {
-      "version": "0.6.13",
-      "resolved": "https://registry.npmjs.org/@jambonz/db-helpers/-/db-helpers-0.6.13.tgz",
-      "integrity": "sha512-7VXb1q8Jii76XFYMyIjsLr33w5s1DFUN1fjtU+r5PpZQuM7YXhVHfOW3q0652RMrEP2vqW2h6cpBNclvLPJzjg==",
+      "version": "0.6.14",
+      "resolved": "https://registry.npmjs.org/@jambonz/db-helpers/-/db-helpers-0.6.14.tgz",
+      "integrity": "sha512-dWUjDb2If9NwUpUxlAJ4PbIWRyA1gZTkmiICix/f76yAF5aGCf0hgOiYXlh335BRYsX5By41yS7DkLXaTxbx9g==",
       "requires": {
         "cidr-matcher": "^2.1.1",
         "debug": "^4.3.1",
diff --git a/package.json b/package.json
index 4ff6bb90..24cfb709 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "jslint": "eslint app.js lib"
   },
   "dependencies": {
-    "@jambonz/db-helpers": "^0.6.13",
+    "@jambonz/db-helpers": "^0.6.14",
     "@jambonz/mw-registrar": "^0.2.1",
     "@jambonz/realtimedb-helpers": "^0.4.8",
     "@jambonz/stats-collector": "^0.1.5",