Authorization header logged in plaintext
Part of the Observability gaps check · fix arrives as a pull request
What it is
An Authorization header, cookie, or token value is written to logs in plaintext — commonly by logging an entire request or header object.
Why it matters
The token is live. Anyone with log access has whatever it grants, and logs are typically retained longer, replicated further, and read by more people than the systems the token protects.
How to fix it
Configure the logger to redact authorization, cookie, set-cookie, and known token fields, and log a header allow-list rather than the whole object. Rotate anything already exposed, and check your retention window for how far back it goes.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.