Plaintext passwords are not written to logs or errors

A password written to a log file does not expire, does not rotate, and does not observe the principle of least privilege — it is accessible to everyone who can read that log aggregation service. CWE-312 (Cleartext Storage of Sensitive Information) and CWE-532 (Insertion of Sensitive Information into Log File) both apply directly. PCI-DSS broadly requires protection of authentication credentials at rest and in transit, and OWASP A09 (Security Logging and Monitoring Failures) covers logging too much alongside logging too little. A single console.log(req.body) debug statement in the login handler can write millions of plaintext passwords to your log aggregation service before anyone notices.

Destructure the request body before logging so the password variable is never in scope at the log call site:

// Wrong — logs the password
const body = await request.json()
console.log('Login attempt:', body)

// Correct — log only the safe field
const { email, password } = await request.json()
console.log('Login attempt for:', email)
// `password` is never passed to any log call

// For logging middleware, configure redaction:
const logger = pino({
  redact: ['body.password', 'body.currentPassword', 'body.newPassword', 'body.token']
})

After fixing the code, review your log aggregation service (Datadog, Logtail, CloudWatch) for historical entries containing password fields. If found, rotate affected accounts and issue security notifications per your incident response plan.