PII excluded from application logs

CWE-532 (insertion of sensitive information into log files) directly applies when account numbers, SSNs, or email addresses appear in application logs. Financial application logs are typically stored in cloud logging services (CloudWatch, Datadog, Splunk) with broader access than the production database — developers, support staff, and contractors may all have log read access without needing database access. PCI-DSS 4.0 Req-3.3 explicitly prohibits storing sensitive authentication data after authorization. OWASP 2021 A09 (Security Logging and Monitoring Failures) includes inadequate log sanitization. A single console.log(transaction) that dumps the full transaction object will log account numbers in plaintext to every log aggregator in the pipeline.

Create masking utilities in src/lib/logging.ts and use them consistently in all transaction-path logging:

// src/lib/logging.ts
export const mask = {
  accountNumber: (v: string) => `****${v.slice(-4)}`,
  ssn: (v: string) => `***-**-${v.slice(-4)}`,
  email: (v: string) => {
    const [local, domain] = v.split('@');
    return `${local[0]}***@${domain}`;
  },
  cardToken: (v: string) => `tok_****${v.slice(-4)}`,
};

// Usage:
logger.info('transfer_initiated', {
  account: mask.accountNumber(accountNumber),
  amount: transferAmount, // numeric, safe to log
  currency: 'USD',
});

Add a pre-commit lint rule or custom ESLint plugin that flags console.log or logger.* calls in src/app/api/ routes that reference known PII field names (ssn, accountNumber, cardToken, email). Review all existing logs for historical PII exposure and rotate credentials if any appear.