Sensitive Data In Logs (ARCH3160)

Key typescript.logging.sensitive-data-in-logs · Severity error · Category logging

Logging sensitive fields such as passwords, tokens, secrets, API keys, SSNs, or credit cards leaks those secrets to log sinks. Anyone with log access can harvest the credentials.

Incorrect

function login(creds: Credentials) {
  logger.info("login attempt", { email: creds.email, password: creds.password });
  return auth.verify(creds);
}

Correct

function login(creds: Credentials) {
  logger.info("login attempt", { email: creds.email });
  return auth.verify(creds);
}

Fix

Remove or mask sensitive fields from logs; record only non-identifying context.