Sensitive Data In Logs (ARCH7160)

Key php.logging.sensitive-data-in-logs · Severity error · Category logging

Logging sensitive data such as passwords, tokens, secrets, or card numbers leaks secrets into log sinks and exposes them permanently.

Incorrect

<?php
$this->logger->info('Login attempt', [
    'email' => $email,
    'password' => $password,
    'apiKey' => $apiKey,
]);

Correct

<?php
$this->logger->info('Login attempt', [
    'email' => $email,
]);

Fix

Remove or mask sensitive fields from the log context; never log them in clear text.