Skip to content
Sarj Standards

Python · security

no-secret-in-log

python:no-secret-in-log

Secret-like value is passed to a logging call under a secret-like keyword.

Code
SARJ012
Default
error
Fix
none
Languages
python

Why

Raw credentials in logs can spread to durable sinks and readers outside the request boundary.

Fix

Omit the secret or log a deliberately redacted derivative under a redaction-specific name.

Before / after

Executed by this rule’s unit tests.

Before

Raw token passed to a logger

service.py · focus
logger.info('request', token=token)

After

Token prefix logged under a redacted name

service.py · focus
logger.info('request', token_prefix=token[:6])

Limits

  • Detection covers keyword arguments on logger-shaped receivers and known logging methods.
  • Positional values, message interpolation, and values under non-secret keyword names are not inspected.