Sensitive Data in Logs

Detects passwords, tokens, credit card numbers, and other sensitive data written to log files.

zakirkun 335b58a 2 files · 4.0 KB Updated

File contents

Sensitive Data in Logs

Overview

Logging sensitive information creates secondary exposure risks:

  • Log files are often stored less securely than databases
  • Log aggregation services (ELK, Splunk) may have broader access
  • Logs may be shipped to third parties (monitoring vendors)
  • Compliance violations: PCI-DSS (card data), GDPR (PII), HIPAA (health data)

Sensitive data that must not be logged:

  • Passwords, PINs, secrets
  • Credit card numbers, CVV
  • Authentication tokens, session IDs
  • Social Security Numbers, health data

Remediation

  • Use structured logging and explicitly list safe fields
  • Implement a log sanitizer/redactor middleware
  • Never log request bodies wholesale — extract only safe fields
  • Use [REDACTED] placeholders for sensitive fields

zakirkun/ice-tea/tree/main/skills/logging/sensitive-data-logging commit 335b58a845

Frequently asked questions

npx skillmds@latest add zakirkun/sensitive-data-in-logs