- Home
- The 17 checks
- A secret may be going to your logs
🔑 Keys & passwords · Nice to fix (SEV-3)
A secret may be going to your logs
In plain English: Your app may be writing a password or secret key into its logs, the running notes your server keeps. More people and tools can usually read logs than your database.
What happens if you ship it
Passwords or tokens end up in a log service that more people can read than your database.
How to fix it technical
Remove this log line, or log only that the action happened.
Let your AI tool fix it
Paste this into Lovable, Bolt, Cursor, Replit or Claude Code:
Prompt for your AI tool
Fix this problem in my project: A secret may be going to your logs. Remove this log line, or log only that the action happened. Change only what this fix needs, then tell me what you changed and anything I have to do myself.Check your app
Run npx sigship in your project folder. It reports this problem as secret-in-logs, along with 16 other checks. Nothing leaves your computer. New to the terminal?
Questions
Why are secrets in logs a problem?
Logs are copied to hosting dashboards and log services, kept for a long time and shared with teammates, so a secret in a log spreads quietly.
What should I log instead?
That the action happened, and maybe who did it, but never the password, token or key itself.