Sensitive Data in Logging
Description
Detects logging of sensitive data like passwords, API keys, tokens, credit cards, or authentication credentials. Logged sensitive data can be exposed through log files, monitoring systems, or error tracking services.
How to fix
Redact sensitive fields before logging; log actions and usernames, not credentials.
```python
import logging
logger = logging.getLogger(__name__)
SENSITIVE = {'password', 'token', 'api_key', 'secret'}
def sanitize(data):
return {k: '***' if k in SENSITIVE else v for k, v in data.items()}
def login(username, password):
logger.info(f"Login attempt for: {username}") # Log username, not password
authenticate(username, password)
```
Learn more: https://shoulder.dev/learn/python/cwe-532/sensitive-data-logging
Applies to
Languages
References
Scan for this issue
Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=python-sensitive-data-logging .