Sensitive Data Logging (ARCH8128)

Key kotlin.security.sensitive-data-logging · Severity error · Category security · CWE CWE-532

Flags log calls that write a credential-named value (password, token, API key) into the log store.

Incorrect

logger.info("login ok for $user with $password")

Correct

logger.info("login ok for {}", user.id)

Fix

Log an identifier or a masked form (last 4 characters); never the secret itself.