Skip to content
Sarj Code Standards

no-secret-in-log

A direct credential-like reference is passed to a recognized logging call.

SARJ012 Rule source Tests Catalog JSON

Why

Raw credentials in logs can spread to durable sinks and readers outside the request boundary.

Fix

Omit the credential or log only approved non-sensitive metadata through a centralized sanitizer.

Examples

Before — flagged Raw token passed to a logger
service.py
logger.info("request", token=token)
After — preferred Only non-sensitive authentication metadata is logged
service.py
logger.info(
    "request authenticated", auth_method="bearer", credential_present=token is not None
)