---
title: "Keep private data out of logs and · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/private-data-out-of-logs
id: APS-79
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 893
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep private data out of logs and addresses

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Errors, logs and vulnerabilities](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-79
- Level: Recommended
- Chapter: [Errors, logs and vulnerabilities](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities.md)
- Rule: Never put passwords, tokens, card numbers or personal details in addresses or logs.
- Check: The agent logs in, resets a password and places a test order. Then it searches the staging logs for the test password, token and email address. None of them appear.
- How: Send private values in the request body or a header, never in the query string. Addresses end up in logs, browser history and `Referer` headers, as [keep personal data out of addresses](https://agentwranglers.se/playbook/website/privacy/personal-data-out-of-urls.md) explains. Redact fields in the logger and drop IP addresses as [keep personal data out of logs](https://agentwranglers.se/playbook/operations/logs/logs-without-personal-data.md) says. This rule is the attack test for both. Collect less in the first place, as in [data minimization](https://agentwranglers.se/playbook/website/privacy/data-minimization.md).

## Sources

- [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html)

## Related rules

- ENG-23 [Log, track errors and alert](https://agentwranglers.se/playbook/engineering/running-in-production/logs-and-alerts.md) in Engineering
- WEB-212 [Keep only what you need and delete it on time](https://agentwranglers.se/playbook/website/privacy/data-minimization.md) in Website
- OPS-9 [Keep personal data out of logs](https://agentwranglers.se/playbook/operations/logs/logs-without-personal-data.md) in Operations and observability
- OPS-13 [Keep metric labels few and bounded](https://agentwranglers.se/playbook/operations/metrics-and-traces/bounded-metric-labels.md) in Operations and observability
- DEV-7 [Take secrets from the environment or a file instead of a flag](https://agentwranglers.se/playbook/developer-tools/configuration-and-telemetry/no-secrets-in-flags.md) in Developer tools, SDKs and CLIs
- APS-31 [Share less in the Referer header](https://agentwranglers.se/playbook/application-security/browser-security-headers/referrer-policy.md) in Application security
- WEB-214 [Keep personal data out of addresses](https://agentwranglers.se/playbook/website/privacy/personal-data-out-of-urls.md) in Website

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/private-data-out-of-logs">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Show short errors](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/short-errors.md)
- Next: [Log attacks without personal data](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/security-logging.md)
- [Errors, logs and vulnerabilities](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities.md)