Sensitive Data Logging (ARCH8128)
Ce contenu n’est pas encore disponible dans votre langue.
Key kotlin.security.sensitive-data-logging · Severity error · Category security · CWE CWE-532
Flags log calls that write a credential-named value (password, token, API key) into the log store.
Incorrect
Section titled “Incorrect”logger.info("login ok for $user with $password")Correct
Section titled “Correct”logger.info("login ok for {}", user.id)Log an identifier or a masked form (last 4 characters); never the secret itself.