Topic

Secrets in logs

Credentials and sensitive values exposed through application logs, traces, proxies and debugging artefacts.

Current clusters

build1 publisher

Each background job retry gets its own Postgres row in a design built around tenant incident queries

Three separate IDs and one Postgres row per retry let an investigator list every attempt for a tenant in order, according to a dev.to design. Adopting it means carrying an operation ID into every enqueue call, and its sample redactor lets bearer tokens through.

Publishers:dev.to

Reality

Evidence40
Adoption: Insufficient
Hype gap+15
Incentives: Insufficient
Confidence45

build1 publisher

Anyone who reads one STK Push request body can decode the M-Pesa passkey

Safaricom's Daraja STK Push builds its request password as reversible base64 of the passkey and two values that are public or sent in the same body. Any log, APM trace or proxy that captures that body holds a decodable copy of a credential with no documented way to revoke it.

Publishers:dev.to

Reality

Evidence58
Adoption: Insufficient
Hype gap+5
Incentives20
Confidence60