Personal data written to logs
Gaphigh severity · reads .ts .tsx .js .jsx .mjs .cjs .pyBeta
Logs are copied to many places and kept for a long time. Personal data in them is hard to find and delete. When Lintsure finds this, it marks it as a Gap: the code itself shows the problem.
What it looks like
A line Lintsure flags in its own test app:
// src/users.ts
logger.info(`signup ${user.email}`);How to fix it
Mask or remove the personal field before logging, for example mask(user.email).
Through a coding agent, Lintsure suggests the change and waits. Nothing is edited until you approve it.
Controls it relates to
What the framework asks
GDPR Art. 5: Core principles
Use data fairly and openly, only for clear purposes, collect the minimum, keep it accurate, don't keep it longer than needed, and keep it secure.
Evidence a reviewer may ask for: A retention schedule and a note on why each field is collected.
GDPR Art. 32: Security of processing
Protect personal data with security that fits the risk: encryption, access control, testing and the ability to recover.
Evidence a reviewer may ask for: Security measures and when they were last tested.
SOC 2 CC6.1: Logical access
Only the right people and systems can reach data. Secrets are protected, passwords are stored safely.
Evidence a reviewer may ask for: Access settings, secret storage and password hashing.
ISO 27001 A.8.11: Data masking
Hide or reduce sensitive data where full values aren't needed, such as in logs.
Evidence a reviewer may ask for: Masking in logs and test data.
Summaries are our own reading of the public texts, not the official wording.
Read more: How to keep personal data out of your logs
Check your code for this
Runs on your machine. Your code is never uploaded.
npx lintsure scanThis rule is in Beta: its mapping to framework controls is waiting for review by a qualified compliance professional. Lintsure is a readiness tool, not an audit or legal advice. A finding, or the lack of one, doesn't make you compliant. Disclaimer