The current implementation of std::string redact(const DBException& exceptionToRedact) uses an std::stringstream internally, which makes the redact.cpp TU depend on the <ostream> system header.
It looks like this is not necessary, because the current implementation of std::string redact(const Status& statusToRedact) in the same module uses a StringBuilder.
This can be improved so that both functions use a StringBuilder and no std::stringstream. This is more consistent, and apart from that the StringBuilder should have efficiency advantages over std::stringstream.