# Sensitive-data-in-logs / log-injection pre-scan

- target: `sample-repo`
- source files scanned: 6
- findings: HIGH 14 · MEDIUM 9 · LOW 3 · INFO 0

_Deterministic pre-scan — not an audit. Line/window-based; no dataflow. A clean report is not proof nothing sensitive reaches the logs._


## HIGH

- `hostile/app.py:5` **LOG-REQOBJ** — request headers/cookies object into log — carries Authorization + session material (CWE-532)
- `hostile/app.py:8` **LOG-SECRET** — secret material `logging.warning('', session_token)` into log sink — reaches the log file (CWE-532)
- `hostile/app.py:10` **LOG-SECRET** — secret material `logger.info('', connection_string)` into log sink — reaches the log file (CWE-532)
- `hostile/app.py:11` **LOG-SECRET** — secret material `print('', client_secret)` into log sink — reaches the log file (CWE-532)
- `hostile/app.py:17` **LOG-SECRET** — secret material `logger.info('', card_number, cvv)` into log sink — reaches the log file (CWE-532)
- `hostile/main.go:2` **LOG-REQOBJ** — request headers/cookies object into log — carries Authorization + session material (CWE-532)
- `hostile/main.go:4` **LOG-SECRET** — secret material `fmt.Printf('', password)` into log sink — reaches the log file (CWE-532)
- `hostile/svc.js:2` **LOG-REQOBJ** — request headers/cookies object into log — carries Authorization + session material (CWE-532)
- `hostile/svc.js:4` **LOG-SECRET** — secret material `console.log('', apiKey)` into log sink — reaches the log file (CWE-532)
- `hostile/svc.js:5` **LOG-SECRET** — secret material `sessionToken` into log sink — reaches the log file (CWE-532)
- `hostile/svc.js:8` **LOG-SECRET** — secret material `logger.info('', password)` into log sink — reaches the log file (CWE-532)
- `hostile/web.php:2` **LOG-SECRET** — secret material `error_log('' . $password)` into log sink — reaches the log file (CWE-532)
- `hostile/web.php:3` **LOG-REQOBJ** — request headers/cookies object into log — carries Authorization + session material (CWE-532)
- `hostile/web.php:5` **LOG-SECRET** — secret material `$password` into log sink — reaches the log file (CWE-532)

## MEDIUM

- `hostile/app.py:6` **LOG-BODY** — request body/form data into log — arbitrary attacker text (CRLF forging, CWE-117; bodies often carry credentials)
- `hostile/app.py:7` **LOG-BODY** — request body/form data into log — arbitrary attacker text (CRLF forging, CWE-117; bodies often carry credentials)
- `hostile/app.py:9` **LOG-ENV** — environment block into log — env is where secrets are stored (CWE-532)
- `hostile/app.py:12` **LOG-PII** — regulated personal data `logger.info('', ssn)` into log sink — reaches the log file (CWE-532)
- `hostile/app.py:13` **LOG-HASHED** — hashed credential material `logger.info('', password_hash)` into log sink — reaches the log file (CWE-532)
- `hostile/main.go:3` **LOG-CRED** — credential material `slog.Info('', '', token)` into log sink — reaches the log file (CWE-532)
- `hostile/svc.js:3` **LOG-BODY** — request body/form data into log — arbitrary attacker text (CRLF forging, CWE-117; bodies often carry credentials)
- `hostile/svc.js:6` **LOG-ENV** — environment block into log — env is where secrets are stored (CWE-532)
- `hostile/web.php:4` **LOG-BODY** — request body/form data into log — arbitrary attacker text (CRLF forging, CWE-117; bodies often carry credentials)

## LOW

- `hardened/app.py:9` **LOG-CRED** — sliced credential prefix `logger.info('', token[:4])` into log sink — reaches the log file (CWE-532)
- `hostile/app.py:14` **LOG-INPUT** — request header/query value into log — log-forging text (CWE-117)
- `hostile/svc.js:7` **LOG-INPUT** — request header/query value into log — log-forging text (CWE-117)