node-media-server logs errors only: its info lines printed stream keys

ddiff --git a/SECURITY_AUDIT.md b/SECURITY_AUDIT.md
iindex ff844f6d..268ee692 100644
---- a/SECURITY_AUDIT.md
++++ b/SECURITY_AUDIT.md
@@@ -49,7 +49,7 @@ test/authorization were also run against the previous code and failed there, cas
  | Medium | Kiosk link preview followed redirects to internal services and returned their `<title>`. | egress.fetchText. | egress |
  | Medium | Chat-relay YouTube host check used `includes` (`youtube.com.evil`), unbounded fetch. | Exact host/subdomain match; guarded, size-capped fetch. | manual |
  | Medium | Public VOD/clip lists passed `include_private` to Media under the app key. | Stripped on public lists. | manual |
--| Medium | Stream keys in logs (RTMP publish/reject/end, restream command lines incl. SRT passphrases, RS worker ffmpeg line). | server/utils/redact.js. | manual |
++| Medium | Stream keys in logs (RTMP publish/reject/end, restream command lines incl. SRT passphrases, RS worker ffmpeg line, node-media-server's own connect/publish/play lines). | server/utils/redact.js; the library logs errors only. | manual |
  | Medium | OAuth callback skipped the state check when the cookie was missing (login CSRF). | State cookie required. | manual |
  | Medium | Media request state (public + broadcast to chat) exposed server file paths and raw yt-dlp errors; `stream-url` returned raw errors to anyone. | Public projection; raw errors only for channel managers. | manual |
  | Medium | Real-money Vibes balance and last-seen time on public profiles. | Only for the user themself. | manual |
ddiff --git a/deploy/scripts/deploy.sh b/deploy/scripts/deploy.sh
iindex 29179263..8de0f2fa 100755
---- a/deploy/scripts/deploy.sh
++++ b/deploy/scripts/deploy.sh
@@@ -290,8 +290,8 @@ if [ "$LAYOUT" = release ]; then
      fi
  
      if has "$CATS" nginx; then
--        say "note: deploy/nginx changed. The live nginx config is generated by OpenVibe.Network's"
--        say "      nginx generator and is NOT installed by this script — apply the change there and run nginx -t."
++        say "note: deploy/nginx changed and is NOT installed by this script — copy it to /etc/nginx/sites-available,"
++        say "      run nginx -t and reload (OpenVibe.Network's generator mirrors it)."
      fi
  
      [ "$DRY_RUN" = "1" ] && { say "dry run complete — nothing was changed."; exit 0; }
@@@ -391,7 +391,7 @@ if [ "$DRY_RUN" != "1" ] && [ "$OLD_HASH" != "$TARGET_HASH" ] && deps_changed "$
      say "warning: legacy layout — a rollback would NOT restore the previous node_modules. Migrate to releases."
      run $NPM ci --omit=dev --no-audit --no-fund || die "npm ci failed" 2
  fi
--has "$CATS" nginx && say "note: deploy/nginx changed — apply it through OpenVibe.Network's nginx generator; not installed here."
++has "$CATS" nginx && say "note: deploy/nginx changed — not installed here; copy it, nginx -t, reload (see docs/deploy.md)."
  
  if [ "$DRY_RUN" = "1" ]; then say "dry run complete — nothing was changed. restart needed: $NEEDS_RESTART"; exit 0; fi
  
ddiff --git a/server/streaming/rtmp-server.js b/server/streaming/rtmp-server.js
iindex a9a0d287..fb8ba5c2 100644
---- a/server/streaming/rtmp-server.js
++++ b/server/streaming/rtmp-server.js
@@@ -35,6 +35,9 @@ class RTMPServer extends EventEmitter {
          }
  
          const nmsConfig = {
++            // ERROR only: the library's info lines print streamPath, i.e. /live/<stream key>, into the
++            // journal on every connect/publish/play. Our own [RTMP] lines are redacted.
++            logType: 1,
              rtmp: {
                  port: config.rtmp.port,
                  chunk_size: config.rtmp.chunkSize,