Sensitive data logging (ARCH330)

Key dotnet.security.sensitive-data-logging · Severity error · Category security · CWE CWE-532

Writing passwords, tokens, or secret keys to logs causes that sensitive data to be stored in plaintext across log files, log aggregation systems, and backups.

Incorrect

_logger.LogInformation(
    "Login attempt: user={User}, password={Password}",
    user.Email, request.Password);

Correct

_logger.LogInformation(
    "Login attempt: user={User}", user.Email);

Fix

Never log passwords, tokens, or secrets at any level; mask values or log only presence/identity information when needed.