Secrets not exposed in error messages or logs

Error handlers that serialize console.error(err, req) or JSON.stringify(error) inadvertently capture Authorization headers, database connection strings from caught exceptions, and environment variable snapshots. CWE-532 (Insertion of Sensitive Information into Log File) and OWASP A09 (Security Logging and Monitoring Failures) cover this. NIST 800-53 AU-3 requires log content to not expose sensitive data. Logs shipped to a third-party service (Datadog, Logtail, Axiom) mean those credentials are now in an external system with its own access controls, multiplying the exposure surface. A single console.error(process.env) in an error handler is a complete secrets exfiltration.

Implement a logError function that redacts sensitive keys before writing to any log sink:

// lib/logger.ts
const SENSITIVE = new Set(['password', 'token', 'secret', 'authorization', 'cookie', 'key'])

function redact(obj: unknown, depth = 0): unknown {
  if (depth > 5 || obj === null || typeof obj !== 'object') return obj
  return Object.fromEntries(
    Object.entries(obj as Record<string, unknown>).map(([k, v]) => [
      k,
      SENSITIVE.has(k.toLowerCase()) ? '[REDACTED]' : redact(v, depth + 1),
    ])
  )
}

export function logError(err: unknown, ctx?: Record<string, unknown>) {
  console.error(JSON.stringify({
    level: 'error',
    message: err instanceof Error ? err.message : String(err),
    context: ctx ? redact(ctx) : undefined,
    timestamp: new Date().toISOString(),
  }))
}

Never pass req or process.env directly to a logger. Pass only the specific context fields the error needs.