Sensitive Data in Logs

Detects passwords, tokens, credit card numbers, and other sensitive data written to log files.

zakirkun Updated

File contents

Sensitive Data in Logs

Overview

Logging sensitive information creates secondary exposure risks:

  • Log files are often stored less securely than databases
  • Log aggregation services (ELK, Splunk) may have broader access
  • Logs may be shipped to third parties (monitoring vendors)
  • Compliance violations: PCI-DSS (card data), GDPR (PII), HIPAA (health data)

Sensitive data that must not be logged:

  • Passwords, PINs, secrets
  • Credit card numbers, CVV
  • Authentication tokens, session IDs
  • Social Security Numbers, health data

Remediation

  • Use structured logging and explicitly list safe fields
  • Implement a log sanitizer/redactor middleware
  • Never log request bodies wholesale — extract only safe fields
  • Use [REDACTED] placeholders for sensitive fields

zakirkun/ice-tea/tree/main/skills/logging/sensitive-data-logging commit 335b58a845

Frequently asked questions

npx skillmds@latest add zakirkun/sensitive-data-in-logs