Sensitive Data Logging (ARCH5128)

Key go.security.sensitive-data-logging · Severity error · Category security · CWE CWE-532

Writing a password, token, or personal data into a log message leaks credentials into log stores and monitoring systems.

Incorrect

func login(log *slog.Logger, user, password string) {
  log.Info("login attempt", "user", user, "password", password)
}

Correct

func login(log *slog.Logger, user, password string) {
  log.Info("login attempt", "user", user)
}

Fix

Never log sensitive fields; mask them if needed, or record only non-identifying metadata.