Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-015

Sensitive data in console.log

mediumJavaScript / TypeScriptCWE-532CVSS 5.3

What it detects

Logging sensitive information such as passwords or tokens can leak data.

How to fix

Remove sensitive data from log statements. Use structured logging with redaction.

Vulnerable — Shield flags thisauth.js
const express = require("express");
const app = express();

app.post("/login", async (req, res) => {
  const { username, password } = req.body;
  console.log("login attempt", username, password);
  const ok = await verifyCredentials(username, password);
  res.status(ok ? 200 : 401).end();
});
Fixed — scans cleanauth.js
const express = require("express");
const app = express();

app.post("/login", async (req, res) => {
  const { username, password } = req.body;
  console.log("login attempt", username);
  const ok = await verifyCredentials(username, password);
  res.status(ok ? 200 : 401).end();
});

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-015, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-015: Sensitive data in console.log — Zennoxa Shield