Sensitive values written to logs
MediumAV-DATA-001Secrets & data exposureCore pack
What it finds
A log or print statement includes a field named like a password, key, token, or personal identifier.
Why it matters
Logs are copied to many places (log services, support tickets, dashboards) and are rarely protected like a secret store. Credentials or personal data in logs leak quietly.
What an attacker could do: Anyone with log access could obtain credentials or customer personal data.
How to fix it
Never log secrets or personal identifiers. Log a request ID instead, and add redaction to your logger for known sensitive field names.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- SENSITIVE_DATA_IN_LOGS
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Any text-based agent source or configuration (JS/TS/Python/JSON/YAML)
- OWASP LLM Top 10
- LLM06 - Sensitive Information Disclosure
- NIST AI RMF
- MS-2.10, GV-1.1
- SOC 2
- CC6.1, P4.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Hardcoded credentials (generic pattern)AV-SECRET-001 · Critical
- Credential or secret placed in the system promptAV-DATA-002 · High
- Data exfiltration path: private data + untrusted input + outbound channelAV-DATA-003 · High
- Credential stored in plain text in the MCP configAV-MCP-102 · High
- All environment variables handed to an MCP serverAV-MCP-111 · High
- Personal data sent to the model without redactionAV-DATA-004 · High