Sensitive data logging (ARCH2128)

Key python.security.sensitive-data-logging · Severity error · Category security · CWE CWE-532

Logging passwords, tokens, or PII leaks credentials into log stores. Do not log sensitive fields, or mask them first.

Incorrect

import logging

def login(user, password):
    logging.info("login attempt user=%s password=%s", user, password)

Correct

import logging

def login(user, password):
    logging.info("login attempt user=%s", user)

Fix

Omit sensitive fields from logs, or mask them before logging.