Web › Module 9 › Lesson 3
Privacy vs Useful Logs
Useful security logs without turning logs into a second breach.
Visual · privacy_vs_logs
Log line with secrets redacted, ids kept. then redact the local log. Router admin STOP. No doxxing via logs.
Opening
A09 fails twice when logs are empty — and when logs become a PII dump.
OWASP Top 10:2025 A09 Security Logging and Alerting Failures includes logging that is useless and logging that is dangerously rich: passwords, tokens, full PANs, health data, or private messages in cleartext. Attacker goal after a log-store breach: instant credential replay. Cyberlium: redact and minimize on apps YOU own. Do not scrape foreign logs for “PII practice.” Practical commands: ; if router login, STOP. Curl DEMO only as YOUR lab app, append a local log, then run the redact toy on fake fields — never on a gateway password prompt. Next: logging checklist lab. Today: privacy vs usefulness.
1. Never-log list: secrets and regulated payloads
Never log: passwords, password resets tokens, API keys, session tokens, refresh tokens, CVV, full primary account numbers, private keys. Prefer not to log full raw request bodies on auth routes. If a library logs them by default, turn that off on YOUR stack.
Authorization headers and cookies belong in the never-log list unless redacted to presence-only flags.
Command guide
A09 Logging — Never-log list
═══ COMMANDS ═══
Command — copy this
sed "s/Bearer .*/Bearer [REDACTED]/" "$HOME/cyberlium-lab/a09-privacy-toy.txt" sed "s/Bearer .*/Bearer [REDACTED]/" "$HOME/cyberlium-lab/a09-privacy-toy.txt" sed "s/Bearer .*/Bearer [REDACTED]/" "$HOME/cyberlium-lab/a09-privacy-toy.txt"
Command — copy this
sed "s/Bearer .*/Bearer [REDACTED]/" "$HOME/cyberlium-lab/a09-privacy-toy.txt"
2. Minimize and mask: enough to investigate
User id beats email when email is sensitive in your jurisdiction. Mask emails (j***@example.com) if needed. Truncate tokens to last4 for correlation only when policy allows. Hashing identifiers can help — document the scheme. Do not invent irreversible hashing of passwords into logs as a “clever” substitute for not logging them.
Access control on log stores: only incident roles. Retention limits reduce blast radius.
Command guide
A09 Logging — Minimize and mask
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
python3 - << PY
s = "Authorization: Bearer lab-secret-demo"
print(s.replace("lab-secret-demo", "[REDACTED]"))
print("enough to investigate; not a wallet dump")
PY3. Debug vs production: levels and sampling
Verbose debug that prints bodies may be OK on a local 127.0.0.1 profile you own — never as default in production. Sampling high-volume events can keep costs down without losing security signals if you keep all auth failures.
Separate security audit streams from chatty app debug when you can.
4. Legal and ethics: your users’ data is not a portfolio
Do not export real user logs to public gists. Do not use classmate accounts’ data in screenshots. Do not hydra the router and paste its password into notes. Cite A09. Original Cyberlium — not official OWASP certification.
chmod 600 for notes that discuss field policies.
5. Wrong vs right: dump everything vs redact+must-log
Same word “visibility,” opposite harm.
Wrong
Log passwords/tokens/PANs. Public-gist real user logs. Scrape foreign SIEM for PII drills. Hydra 192.168.0.1. nmap the LAN.
Right
Identify DEMO; router → STOP. Never-log list + mask policy on YOUR app; lock privacy-logs-notes.txt. Next: Lab — Logging Checklist for Your App.
6. Hands-on: redact toy + DEMO identify + privacy-logs-notes.txt
Toy redactor shows masking — it is not a license to process strangers’ data or router passwords. Identify DEMO first.
Mission: privacy-logs-notes.txt (mode 600)
1) Optionally curl DEMO and append a redacted local log line.2) Write never-log and mask/minimize rules; separate prod vs local debug policy. 3) chmod 600 $HOME/cyberlium-lab/privacy-logs-notes.txt. No real-user gists. No hydra. No nmap.
Stuck? Ask Cyberlium AI Mentor
If “useful” still means “log the password,” ask for a hint. Try: "Hint only: never-log list; how to keep user_id without secrets; why 192.168.0.1 router login is OUT OF SCOPE; where notes live?"
Useful security logs stay useful only if they do not become a breach. A09. Original Cyberlium — not official OWASP certification. Next — Lab — Logging Checklist for Your App.
Knowledge Check
APPLY: Framework logs Authorization headers by default. Action on YOUR app?
Multiple choice
Knowledge Check
APPLY: True or False: Logging plaintext passwords is recommended for MFA debugging in production.
True or False
Knowledge Check
APPLY: curl of http://192.168.0.1/ is router admin. Log the password field from the form?
Multiple choice