PII/secret in email or logs
Part of the Email safety check · fix arrives as a guide
What it is
Personal data or a secret is rendered into a message body, or the full send payload including recipient and content is written to logs.
Why it matters
Mail bodies travel through providers and sit in inboxes indefinitely, and logs are usually retained longer and read more widely than the data classification assumed. A one-time code or a reset token in a log line is a live credential.
How to fix it
Send the minimum the message needs and link to the application for the rest. Log an identifier and a status, never the payload, and redact tokens and addresses at the logger rather than at each call site.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.