Security Logs Should Explain Events Without Exposing Secrets

Logs help investigate incidents when they show what happened, when it happened, and which account or service was involved. Recording everything creates new exposure. OWASP’s logging guidance recommends deliberate event selection, protection of log storage, and exclusion or masking of sensitive values.

What matters

• Record authentication failures, permission changes, and important administrative actions.
• Avoid storing passwords, access tokens, and unnecessary personal information.
• Restrict log access, keep timestamps consistent, and test that collection still works.

Practical example: A failed integration records the service name, request identifier, and error category without printing its bearer token.

One action today: Review a sample production log for credentials and missing investigation context.