Prevent Sensitive Data in Logs

Flags logs, error reports, and analytics events that expose passwords, tokens, emails, card data, or raw request bodies without redaction.

Catch this in your code

What it flags

Flaggedbilling/charges.py

import logging

from payments import GatewayError, gateway

logger = logging.getLogger(__name__)


def charge_customer(customer, card, amount_cents):
    # Email, full card number, and CVC reach every log sink
    logger.info("Charging %s card=%s cvc=%s", customer.email, card.number, card.cvc)
    try:
        return gateway.charge(card, amount_cents)
    except GatewayError as exc:
        logger.error("Charge failed: %s payload=%s", exc, exc.request_body)
        raise

Passesbilling/charges.py

import logging

from payments import GatewayError, gateway

logger = logging.getLogger(__name__)


def charge_customer(customer, card, amount_cents):
    logger.info(
        "Charging customer_id=%s card_last4=%s amount_cents=%s",
        customer.id,
        card.last4,
        amount_cents,
    )
    try:
        return gateway.charge(card, amount_cents)
    except GatewayError as exc:
        logger.error("Charge failed customer_id=%s code=%s", customer.id, exc.code)
        raise

Why it matters

Logs travel further than the database: to log aggregators, error trackers, analytics tools, and backups, usually with broader access and longer retention. A password or session token written there can be read by anyone with log access, and it is hard to purge once a third-party service has ingested it. The leak usually arrives as a well-meant debugging line, such as logging the whole request body or exception payload, so it looks harmless in review.

Agent instructions

cubic checks every pull request against these instructions. Paste them into AGENTS.md or Cursor rules and your AI coding tool follows them while it writes code.

AGENTS.md

Add this section to AGENTS.md at the repository root. Codex, Cursor, and other AI coding tools read it.

## Prevent Sensitive Data in Logs

Logging, error reporting, analytics events, and audit trails must not expose sensitive data. Flag code that logs PII, emails, passwords, API keys, auth tokens, session identifiers, payment data, or raw request/response bodies without redaction. Error serialization must preserve enough context to debug while sanitizing secrets and user data.

Checks every changed file.

Related agents

Included in the Next.js, TypeScript, Node.js, Python, Django, Ruby on Rails, Go, Spring Boot, and PostgreSQL code review standards.

Run this agent on every pull request

cubic reviews every pull request against the agents you turn on and comments on the lines that break them.