Avoid exposing sensitive information in Log-Messages

Avoid exposing sensitive information in Log-Messages

Description

Simpl-Open shall ensure that log messages do not contain sensitive information to prevent security risks and data leaks.

SMART Breakdown

• Specific: Log messages must not contain passwords, API keys, personal data, or access tokens. Instead, logs should be sanitised and store only necessary metadata.
• Measurable: Measured by conducting log audits and automated security scans to detect sensitive information in logs.
• Achievable: Achieved by configuring logging frameworks (e.g., ELK Stack) to filter out sensitive data and enforce log sanitisation policies.
• Realistic: Logging best practices ensure compliance with security regulations (GDPR, ISO 27001, NIST).
• Timely: Implemented during development, with regular log monitoring and security reviews to maintain compliance.

Back to Simpl requirements overview