Sensitive data logging (ARCH3128)

Key typescript.security.sensitive-data-logging · Severity error · Category security · CWE CWE-532

Logging sensitive data such as passwords, tokens, or personal data leaks credentials into log stores and exposes them to unauthorized access.

Incorrect

app.post("/login", (req, res) => {
  logger.info(`Login attempt: ${JSON.stringify(req.body)}`);
  // body.password written to the log in cleartext
});

Correct

app.post("/login", (req, res) => {
  logger.info("Login attempt", { user: req.body.username });
  // password is never logged
});

Fix

Strip or mask sensitive fields before logging; record only non-identifying fields.