Sensitive data logging (ARCH7128)

Key php.security.sensitive-data-logging · Severity error · Category security · CWE CWE-532

Logging passwords, tokens, API keys, or personal data leaks credentials into log stores and to everyone with access to them. Sensitive fields must be stripped or masked before logging.

Incorrect

<?php
error_log('Login attempt: ' . json_encode($_POST));
// $_POST['password'] is written to the log

Correct

<?php
$safe = $_POST;
unset($safe['password'], $safe['token']);
error_log('Login attempt: ' . json_encode($safe));

Fix

Strip or mask sensitive fields such as passwords, tokens, and PII before logging.