ASVS 5.0 V16.2.3 requires that the application stores or broadcasts logs only to the files and services listed in the log inventory from V16.1.1. It is Level 2. Every log sink must be known, approved and recorded, and anything else should be blocked or flagged.
Why it matters
Logs carry identifiers, errors and sometimes data that should not travel far. A debug file left in a temp folder, a third party error tracker added by one developer, or a console dump collected by an unmanaged agent all create copies with no retention rule and no access control.
How to implement it
Centralize logging configuration so there is one place to see destinations. Ship to stdout and let the platform route it:
# logging config in one shared library
handlers:
- type: stdout
format: json
# no file handlers, no direct third party HTTP handlers
Add controls around it:
- Review changes to logging configuration like security changes.
- Restrict outbound network access so the app can only reach the approved log endpoint.
- Mount the application filesystem read only except for a known scratch path.
- Search dependencies for SDKs that ship telemetry on their own, and disable that where unwanted.
How to test it
List every file the application writes under load and every host it connects to. Compare both lists to the inventory. Turn on verbose mode in a test environment and confirm the extra output still goes only to approved destinations.
Common mistakes
- Developers adding a file handler for debugging and leaving it.
- Crash reporting libraries sending data to a vendor not in the inventory.
- Forgetting stack traces written to the web server's own error log.
Quick check
Do standard output logs count as a destination?
Yes. They should appear in the inventory along with where the platform sends them.
