---
title: "Keep private data out of logs and · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-data-out-of-logs
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep private data out of logs and addresses

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)
- Rule: Never put passwords, tokens, card numbers or personal details in addresses or logs.
- How: Send private values in the request body or a header, never in the query string. Addresses end up in logs, browser history and `Referer` headers. Mask known private fields before they reach the logger. Collect less in the first place, as in [data minimization](https://agentwranglers.se/playbook/website/privacy/data-minimization).
- Check: The agent logs in, resets a password and places a test order. Then it searches the staging logs for the test password, token and email address. None of them appear.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-data-out-of-logs`.

- Previous: [Return only the fields needed](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/only-needed-fields)
- Next: [Encrypt data on the wire and on disk](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/encrypt-data)
- [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)