Sensitive data logging (ARCH6128)

Key ruby.security.sensitive-data-logging · Severity error · Category security · CWE CWE-532

Logging passwords, tokens, or personal data leaks those credentials into log stores; anyone with access to the log files can capture them.

Incorrect

def sign_in(params)
  Rails.logger.info("login #{params[:email]} pw=#{params[:password]}")
end

Correct

def sign_in(params)
  Rails.logger.info("login attempt", email: params[:email])
end

Fix

Remove or mask secrets and sensitive data from logs; configure parameter filtering.