Fix sensitive data written to a log in NestJS

A password, token, cookie, or similar value is passed to a log sink. Centralised logs are widely readable inside an organisation and often retained for months - a credential that lands there is a credential that has left the application's control.

medium likely NestJS CWE-532 / OWASP A09:2021

The vulnerable pattern in NestJS

MEDIUM likely Sensitive data written to a log A09:2021 src/users/users.controller.ts:48:23 46 │ ) { 47 │ // sensitive-data-logged 48 │ this.logger.log({ password: body.password }) │ ~~~~~~~~~~~~~~~~~~~~~~~ sensitive value written to a log 49 │ 50 │ // sensitive-data-logged: an access token, logged the same way.

This finding comes from the NestJS fixture in the owlwarden test suite. Logs are copied into aggregators, retained for months, and readable by anyone with access to the logging system. A credential that reaches a log has left the application's trust boundary.

The corrected handler

Use the Nest logger with a redacted payload.

this.logger.log({ event: 'login_attempt', userId })
// never: this.logger.log({ password: dto.password })

If you are not using NestJS

Log a redacted shape - an id, a boolean, a length - never the secret itself.

Check your own repository

npx owlwarden scan
npx owlwarden explain sensitive-data-logged

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other NestJS checks

Rules with a tested NestJS example.

sensitive-data-logged for every framework / All rules / owlwarden