Source code
Security & compliance
Stability
User object logged — may write PII to logs
Part of the GDPR & privacy check · fix arrives as a pull request
What it is
A user object is passed to a logger, so whatever fields it carries — email, name, address, identifiers — are written to logs.
Why it matters
Logs are retained longer, replicated wider, and read by more people than the database. Personal data in logs is also in scope for access and erasure requests, and log stores are rarely built to satisfy either.
How to fix it
Log a user identifier rather than the object, and configure the logger to redact known personal fields as a backstop. Check your retention window to understand how much history is affected.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.