Skip to content
Sarj Sarj Sarj Standards

no-secret-in-log

A direct credential-like reference is passed to a recognized logging call.

SARJ012 Rule source Tests Catalog JSON

Why

Raw credentials in logs can spread to durable sinks and readers outside the request boundary.

Fix

Omit the credential or log only approved non-sensitive metadata through a centralized sanitizer.

Examples

Before — flagged Raw token passed to a logger
service.py
logger.info("request", token=token)
After — preferred Token prefix logged under a redacted name
service.py
logger.info(
    "request authenticated", auth_method="bearer", credential_present=token is not None
)