What never to log: passwords, tokens, keys and session IDs

Do not write passwords, access tokens, encryption keys or session IDs into logs. OWASP says these should usually not be recorded directly, and should be removed, masked, sanitised, hashed or encrypted. Logs are copied widely and kept for long, so one leaked secret in a log can outlive the secret's intended life.

The list to exclude

OWASP's logging guidance names:

• authentication passwords
• access tokens
• encryption keys and other primary secrets
• session identification values
• database connection strings
• source code
• sensitive personal data, bank account and payment cardholder data
• commercially sensitive information

It also says to never log data unless legally sanctioned.

How to handle what you still need

• Session events. Replace the session ID with a hashed value so events can be correlated without exposing a usable ID.
• Other secrets. Remove, mask or hash before the event is recorded.
• Identity. If the person need not be identified, pseudonymise.
• Log injection. Neutralise carriage return, line feed and delimiter characters in event data.
• Malformed fields. Omit or replace the bad field and log the validation failure, rather than dropping the whole event.

Where secrets sneak in

1. Request and response body logging in debug mode.
2. URLs containing tokens in the query string.
3. Exception messages that echo connection strings.
4. CI output. GitHub's documentation notes that redaction does not cover everything, so mask non-secret sensitive values yourself and avoid passing secrets on the command line.
5. Third-party SDK debug logs.

Protect the logs themselves

OWASP says to restrict read access, record and monitor access to logs, build in tamper detection, and send logs over secure transport such as syslog over TLS. Use a separate database account for log writing with very restrictive permissions. Keep data for the required retention period and no longer.

If a secret was logged

Treat it as exposed. Revoke and rotate it, then purge or redact the log lines where you can. See rotating secrets without downtime.

Add automated checks so the rule survives staff changes. A unit test that logs a sample login request and asserts the output contains no password field is cheap. A scheduled search of recent logs for strings shaped like tokens or keys catches what tests miss. When something is found, fix the source line, not just the log entry, and record the incident like any other exposure.

Quick check

Sources

• OWASP Logging Cheat Sheet
• OWASP Secrets Management Cheat Sheet
• GitHub Docs, Using secrets in GitHub Actions

Last reviewed: 19 October 2026.