← All fixes

Fix it

Logging passwords or tokens — how to fix it

Medium severityCWE-532 (Insertion of Sensitive Information into Log File)

Logging a whole request body, or the headers, on a route that handles authentication copies passwords, tokens, and API keys straight into your logs in plain text. Those logs flow into aggregators, error trackers, and backups where they persist far longer than intended and are readable by anyone with log access. Log only the non-sensitive fields you actually need.

Why it's a problem

Secrets in logs are secrets in a second, less-guarded place. Log platforms are widely accessible within a team, retained for a long time, and often shipped to third-party services, so a password captured in a log is exposed to everyone and everything that can read those logs. It also turns a minor log leak into a credential breach.

The pattern

app.post("/login", (req, res) => {
  console.log("login attempt", req.body); // logs the password
  // ...
});

The fix

app.post("/login", (req, res) => {
  console.log("login attempt", { email: req.body.email });
  // never log passwords, tokens, or full request bodies
});

Why AI tools write this

Logging the request for debugging is a natural, helpful-looking addition, and dumping req.body is the quickest way to see everything. The assistant is not tracking which fields are secret, so it logs the whole object, password included.

The quick fix

  • Log only the specific non-sensitive fields you need, never the full request body.
  • Redact passwords, tokens, API keys, and authorization headers before logging.
  • Scrub existing logs if secrets were already written to them.

Want to know if this pattern is already in a repo you shipped? Scan a public repo free, no account needed.

Scan a repo →
Sensitive Data in Logs (Passwords, Tokens) — How to Fix It: Prbl