Sensitive data logging (ARCH4128)
Ce contenu n’est pas encore disponible dans votre langue.
Key java.security.sensitive-data-logging · Severity error · Category security · CWE CWE-532
Writing passwords, tokens, or PII to logs leaks those credentials into log stores, aggregators, and to anyone with access to them.
Incorrect
Section titled “Incorrect”log.info("Login attempt user={} password={}", username, password);Correct
Section titled “Correct”log.info("Login attempt user={}", username);Remove or mask sensitive fields from logs; record only non-sensitive identifying context.