Secrets Written to Logs

Why it matters

Logs end up in hosting dashboards, log services, support tickets and backups, all of which have wider access than the application itself. A password or token in a log line is a leak with a timestamp. AI tools add these lines while debugging and rarely remove them.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

console.log('login', email, password);

The smallest fix

// Log identifiers and outcomes, never credentials or whole payloads:
console.log('login attempt', { email: req.body.email, ok });

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

// Use a logger with redaction so slips are caught automatically:
import pino from 'pino';
const log = pino({ redact: ['req.headers.authorization', '*.password', '*.token', '*.apiKey'] });

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

How to check the fix worked

1. Trigger the code path and read the log output. No password, token or
   key value may appear.
2. Confirm the log line still carries enough context to debug (user id,
   request id, outcome).

Further reading

• https://cwe.mitre.org/data/definitions/532.html