Zennoxa Shield
Rules / Kotlin
SHIELD-KOTLIN-016

Sensitive data logged via Log statements

mediumKotlinCWE-532CVSS 5.5

What it detects

Passing a password, token, or secret to Log.d/Log.e/Log.i leaks credentials into device logs.

How to fix

Never log secrets; redact sensitive fields and disable verbose logging in release builds.

Vulnerable — Shield flags thisAuthLogger.kt
import android.util.Log

fun onLoginFailed(username: String, password: String) {
    Log.w("Auth", "login failed user=$username password=$password")
}
Fixed — scans cleanAuthLogger.kt
import android.util.Log

fun onLoginFailed(username: String) {
    Log.w("Auth", "login failed user=$username")
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-016, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-KOTLIN-016: Sensitive data logged via Log statements — Zennoxa Shield