Agent WranglersErrors, logs and vulnerabilities
Show short errors and log attacks without personal data. Publish how to report a hole, fix each one in time and know what to do in a breach.
- Recommended 6
Recommended
Show short errors
APS-78Show visitors a short error with a reference number. Keep stack traces, queries and file paths in the server log.
Keep private data out of logs and addresses
APS-79Never put passwords, tokens, card numbers or personal details in addresses or logs.
Log attacks without personal data
APS-80Log failed logins, refused access and rate limit hits, and alert on spikes. Keep personal data out of the log.
Fix each finding within the time its severity allows
APS-81Triage every reported vulnerability within 2 working days. Fix a critical one within 7 days, high within 30, medium within 90 and low within 180, or record a dated risk acceptance.
Publish a vulnerability disclosure policy
APS-107Publish a vulnerability disclosure policy at a fixed address and link it from
security.txt. It names what is in scope, how to report, how fast you answer, and that you will not take legal action against good-faith research.Keep a security incident runbook and rehearse it
APS-108Keep a runbook for a security breach with scripts that revoke every session, rotate every secret and preserve logs. Run it as a drill on staging at least every 12 months.
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.