How would you handle a situation where application logs reveal PII data exposure?