That line about tokens sitting in the URL logs since January is what got me. That's months of them just sitting there, and you'd never know unless somebody showed you. I had the same thing happen with a webhook setup where I was logging full requests to debug something and forgot to turn it off. Took me weeks to notice, and by then those logs had been copied to a backup I wasn't even watching. Swapping to headers is the easy part, it's the stuff already logged that keeps you up at night.

Wait, he actually told you it looked like you did it in the dark with safety scissors? That is wild for a guy who just took your money and held clippers near your face. I would have laughed out loud right there in the chair, then tipped him extra for being the only honest barber in town.