PII/Secrets in Logs

Risk Statement: Logging of PII or secrets in logs exposes sensitive data and can lead to breaches.

Triggers/Signals:

• Detection of passwords, API keys, or tokens in log entries
• Static code scanning reveals logging of sensitive variables
• Security audits or penetration tests flag insecure logging practices
• Incident reports of secrets being exposed

Likelihood: Medium

Impact: High

Mitigations:

• Implement structured logging and ensure sensitive fields are masked or excluded
• Centralize logs and restrict access via RBAC
• Use log scanning tools to detect secrets and PII in logs
• Provide developer guidelines and training on secure logging practices
• Suppress debug logs in production environments

Owner: Security Lead / DevOps team

Residual Risk: Low after sanitization and continuous monitoring