Agent WranglersAPS-80Recommended
Log attacks without personal data
Log failed logins, refused access and rate limit hits, and alert on spikes. Keep personal data out of the log.
How to do it
Write one line per event with the time, the route, the reason and an account ID rather than an email. Never log passwords, tokens or full card numbers. Send an alert when failures jump, such as 50 failed logins in a minute. Keep logs only as long as you need them.
Examples
JSON example
{"time":"2026-11-02T10:14:03Z","event":"login_failed","route":"/login","account":"a_81f2","reason":"bad_password"}How to check
Run 3 failed logins and a refused request. Each appears in the log, and no password, token or email does. On the test copy, a burst of 50 failed logins in a minute sends an alert.
Sources
Related rules
- OPS-76 Escape line breaks in every logged value in Operations and observability
- PAY-57 Log every staff action on money in Payments and billing
- ACC-31 Show people their own security log in Accounts and identity
- APS-26 Collect reports of blocked content in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/security-logging">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.