Error logs scrubbed of sensitive data

Error logs that contain email addresses, passwords, API keys, or session tokens become a secondary attack surface. CWE-209 (information exposure through error messages) and OWASP A09 (security logging and monitoring failures) both cover this failure mode. NIST SP 800-53 AU-3 requires audit records to contain the right information — but not uncontrolled PII or credentials. A compromised logging pipeline or accidental log export can expose the credentials of every user whose request happened to error during a specific window.

Configure a beforeSend hook in your error tracking service to strip PII and secrets before they leave the process. Apply the same sanitization to your structured logger.

// lib/sentry.ts
Sentry.init({
  dsn: process.env.SENTRY_DSN,
  beforeSend(event) {
    if (event.request?.data) {
      const data = event.request.data as Record<string, unknown>
      delete data.password
      delete data.token
      delete data.authorization
    }
    return event
  },
})

For your logger, sanitize at the call site with a helper: logger.info({ user: omit(user, ['passwordHash', 'mfaSecret']) }, 'User action'). Never log raw request bodies without stripping credential fields first.