Sensitive data in logs (ARCH1001)

Key dotnet.logging.sensitive-data-in-logs · Severity error · Category logging

Sensitive data such as passwords, tokens, or card details can leak permanently once written to logs. Never write these fields to the log.

Incorrect

_logger.LogInformation("User login: {Email} password {Password}", email, password);

Correct

_logger.LogInformation("User login: {Email}", email);

Fix

Remove sensitive fields from log calls; mask them if needed, or pass only non-sensitive identifiers such as an id.