TS · security

←Previous Next→

no-secret-in-log

Disallow passing a secret-named value or a raw request/response blob to a logging call; both leak to log sinks. Redact or omit.

noRawBodyInLognoSecretInLog Rule source Tests Catalog JSON

Why

Logs are widely retained and distributed, so credentials and raw bodies can become durable data leaks.

Fix

Omit the value, log allowlisted non-sensitive context, or use an approved redactor; truncation alone is not a safety guarantee.

Examples

Before — flagged Do not send a secret to logs

src/auth.ts

logger.error("auth failed", { token });

After — preferred Log non-sensitive context instead of the secret

src/auth.ts

logger.info("auth", { requestId });

Options

{
  "additionalProperties": false,
  "properties": {
    "logFunctions": { "items": { "type": "string" }, "type": "array" },
    "loggerNames": { "items": { "type": "string" }, "type": "array" }
  },
  "type": "object"
}