Sensitive Data In Logs (ARCH5160)

Key go.logging.sensitive-data-in-logs · Severity error · Category logging

Logging sensitive identifiers such as passwords, tokens, secrets, or API keys leaks those values into log sinks where they are retained long-term. Secrets must never be logged.

Incorrect

func login(log *slog.Logger, user, password string) {
  log.Info("login", "user", user, "password", password)
}

Correct

func login(log *slog.Logger, user, password string) {
  log.Info("login", "user", user)
  _ = password
}

Fix

Remove sensitive fields from log calls or mask them irreversibly.