CWE-532: Insertion of Sensitive Information into Log File

Description

The product writes sensitive information to a log file.

Architecture and Design

Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.

Distribution

Remove debug log files before deploying the application into production.

Operation

Protect log files against unauthorized read/write.

Implementation

Adjust configurations appropriately when software is transitioned from a debug state to production.

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...