Skip to content
Sarj Sarj Sarj Standards

no-whole-request-response-payload-in-log

Whole request or response payloads passed to logging calls require review.

SARJ436 Rule source Tests Catalog JSON

Why

Request and response bodies often contain personal, financial, or echoed authentication data, while log sinks commonly have broader readership and longer retention.

Fix

Log explicit non-sensitive metadata such as request IDs, response status, counts, or a deliberately sanitized summary. Suppress with a rationale when the payload type is proven public and bounded.

Examples

Before — flagged Whole response payload passed to a logger
service.py
response_body = response.json()
logger.error("provider failed", response_body=response_body)
After — preferred Only explicit response metadata is logged
service.py
logger.error(
    "provider failed", request_id=request.id, response_status=response.status_code
)