TypeScript · security

no-secret-in-log

eslint:no-secret-in-log

Disallow passing a secret-named value or a raw request/response blob to a logging call; both leak to log sinks. Redact or omit.

Default: error
Fix: none
Languages: typescript

Why

Logs are widely retained and distributed, so credentials and raw bodies can become durable data leaks.

Fix

Omit the value or log an explicitly redacted, truncated, or derived non-sensitive field.

Before / after

Executed by this rule’s unit tests.

Before

Do not send a secret to logs

src/auth.ts · focus

logger.error('auth failed', { token });

After

Log an explicitly redacted value

src/auth.ts · focus

logger.info('auth', { tokenPrefix });

Limits

Detection uses configurable logger names and statically recognizable secret names, raw-body names, and redaction markers.

Message IDs

noRawBodyInLognoSecretInLog

Options

{
  "additionalProperties": false,
  "properties": {
    "logFunctions": {
      "items": {
        "type": "string"
      },
      "type": "array"
    },
    "loggerNames": {
      "items": {
        "type": "string"
      },
      "type": "array"
    }
  },
  "type": "object"
}