No sensitive data in logs

CWE-532 (Insertion of Sensitive Information into Log File) is a direct path to credential theft: password hashes, session tokens, and API keys logged to stdout end up in your log aggregation platform, which typically has far weaker access controls than your primary database. PCI-DSS Req 10.3.3 explicitly prohibits logging cardholder data in any form; GDPR Art. 32 requires appropriate safeguards for personal data at rest and in transit — your log store is both. A single logger.info(req.body) in a payment handler can land card numbers, CVVs, and billing addresses in a third-party SaaS log platform, creating a compliance violation that persists for your entire log retention window. OWASP A09 lists sensitive data in logs as a primary logging failure mode.

Never log objects wholesale. Select only the fields you need, using explicit destructuring or field picks.

// WRONG — leaks everything in the user object including passwordHash
logger.info(user)
logger.debug(req.body)

// RIGHT — log only non-sensitive identifiers
logger.info({ userId: user.id }, 'User action')
logger.debug({ path: req.path, method: req.method }, 'Request received')

For Sentry, add a beforeSend scrubbing hook in your Sentry config file:

Sentry.init({
  dsn: process.env.SENTRY_DSN,
  beforeSend(event) {
    if (event.request?.data) { delete event.request.data }
    return event
  }
})

After patching, run grep -r 'logger\.(info|debug|error)(user\|req\.body\|ctx)' app/ lib/ to confirm no wholesale object logging remains.