Checks · HYG-003

HYG-003 · Console logs of tokens or personal data

Why it matters

Logs are often stored in a third-party tool. Tokens and email addresses do not belong there.

How we detect it

Logging calls include variables named like token, password or email.

How we fix it

Remove the value or replace it with a redacted label.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-007 · Source maps public in production
• DB-008 · Migrations not in repo
• HDR-001 · Missing HSTS
• HDR-002 · Missing CSP