SEC-002: Passwords Must Not Be Logged

Attribute	Value
Category	Security Standards
Default Severity	error
Applicable Files	All source code (excluding test files)

Why It Exists (Rationale)

Application logs are frequently distributed across multiple monitoring platforms, log aggregation pipelines (Datadog, Splunk, CloudWatch), and local debug outputs. When sensitive credentials such as plaintext passwords, session tokens, or API secrets are logged:

• Access control to logs is typically broader than access control to primary databases.
• Compliance regulations (PCI-DSS, GDPR, HIPAA, SOC 2) are violated.
• Credentials become exposed to support engineers, contractors, and third-party monitoring vendors.

Logging mechanisms must redact credentials prior to outputting request or event bodies.

Bad Example

// ❌ Logging full authentication payload containing raw passwords
router.post("/auth/login", async (req, res) => {
  const { username, password } = req.body;
  logger.info(`Login attempt for ${username} with password ${password}`);
  console.log("Request payload:", req.body);
  // ...
});

Good Example

// ✅ Redacting sensitive properties before logging
router.post("/auth/login", async (req, res) => {
  const { username } = req.body;
  logger.info({ username, action: "login_attempt" });
  // Passwords and authorization headers are never logged
  // ...
});

How It's Detected

ArchStandards detects invocations of standard logging methods (console.log, logger.info, logger.debug, log.warn, etc.) whose argument strings or property accesses contain sensitive keywords (password, passwd, pwd, secret, token, apiKey, credential).

Exception Configuration

exceptions:
  - rule: "SEC-002"
    path: "src/debug/synthetic-tracer.ts"
    reason: "Internal test harness running exclusively in disconnected sandbox."