Agent WranglersSupply chain and setup Required
Log attacks without personal data
Log failed logins, refused access and rate limit hits, and alert on spikes. Keep personal data out of the log.
How to do it
Write one line per event with the time, the route, the reason and an account ID rather than an email. Never log passwords, tokens or full card numbers. Send an alert when failures jump, such as 50 failed logins in a minute. Keep logs only as long as you need them.
Example
{"time":"2026-11-02T10:14:03Z","event":"login_failed","route":"/login","account":"a_81f2","reason":"bad_password"}How to check
Run 3 failed logins and a refused request. Each appears in the log, and no password, token or email does. A burst of 50 failed logins in a minute sends an alert.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/security-logging.