---
title: "Log attacks without personal data · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/security-logging
updated: 2026-10-20
licence: "All rights reserved"
---

# Log attacks without personal data

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)
- Rule: Log failed logins, refused access and rate limit hits, and alert on spikes. Keep personal data out of the log.
- How: Write one line per event with the time, the route, the reason and an account ID rather than an email. Never log passwords, tokens or full card numbers. Send an alert when failures jump, such as 50 failed logins in a minute. Keep logs only as long as you need them.
- Check: Run 3 failed logins and a refused request. Each appears in the log, and no password, token or email does. A burst of 50 failed logins in a minute sends an alert.

Example:

```json
{"time":"2026-11-02T10:14:03Z","event":"login_failed","route":"/login","account":"a_81f2","reason":"bad_password"}
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/security-logging`.

- Previous: [Keep software current and quiet](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/patch-and-hide-versions)
- Next: [Send the security headers](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/security-headers)
- [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)