Agent WranglersData and secrets Required
Keep private data out of logs and addresses
Never put passwords, tokens, card numbers or personal details in addresses or logs.
How to do it
Send private values in the request body or a header, never in the query string. Addresses end up in logs, browser history and Referer headers. Mask known private fields before they reach the logger. Collect less in the first place, as in data minimization.
How to check
The agent logs in, resets a password and places a test order. Then it searches the staging logs for the test password, token and email address. None of them appear.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-data-out-of-logs.