Beginner LevelWeb Security & Cyber Defense
How do you prevent Sensitive Data Exposure in application logs and error traces?
❓ Interview Prompt: Explain PII logging risks, masking credentials/credit cards, suppressing verbose production stack traces, and secure log handling.
Writing sensitive user data into plain-text log files is a major security and compliance violation (GDPR, PCI-DSS, HIPAA):
Prevention Guidelines:
1
Log Redaction Middleware: Intercept and mask sensitive keys ('password', 'creditCard', 'ssn', 'authToken') before writing to console/file.
2
Suppress Stack Traces in Production: Never return raw database or framework stack traces ('err.stack') to API client responses.
3
Access Controls: Restrict log file access to authorized SREs with encrypted storage at rest.
Code Implementation Example
typescript
import winston from 'winston';
// Custom log serializer scrubbing sensitive field keys
const scrubSensitiveData = winston.format((info) => {
if (info.password) info.password = '[REDACTED]';
if (info.creditCard) info.creditCard = '****-****-****-' + info.creditCard.slice(-4);
return info;
});
const logger = winston.createLogger({
format: winston.format.combine(scrubSensitiveData(), winston.format.json()),
transports: [new winston.transports.Console()]
});💡Scrubbing sensitive credentials and PII data from application logs in Winston.
🎯 Interview Key Takeaway
Redact sensitive data (passwords, PII, tokens) from application logs and suppress production error stack traces.
#Data Exposure#Logging#Sanitization#Beginner
Back to all Web Security & Cyber Defense Questions→