---
title: "Log attacks without personal data · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/security-logging
id: APS-80
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 792
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Log attacks without personal data

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Errors, logs and vulnerabilities](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-80
- Level: Recommended
- Chapter: [Errors, logs and vulnerabilities](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities.md)
- Rule: Log failed logins, refused access and rate limit hits, and alert on spikes. Keep personal data out of the log.
- Check: Run 3 failed logins and a refused request. Each appears in the log, and no password, token or email does. On the test copy, a burst of 50 failed logins in a minute sends an alert.
- How: Write one line per event with the time, the route, the reason and an account ID rather than an email. Never log passwords, tokens or full card numbers. Send an alert when failures jump, such as 50 failed logins in a minute. Keep logs only as long as you need them.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JSON example

```json
{"time":"2026-11-02T10:14:03Z","event":"login_failed","route":"/login","account":"a_81f2","reason":"bad_password"}
```

## Sources

- [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html)

## Related rules

- OPS-76 [Escape line breaks in every logged value](https://agentwranglers.se/playbook/operations/logs/log-injection.md) in Operations and observability
- PAY-57 [Log every staff action on money](https://agentwranglers.se/playbook/payments/invoices-and-records/money-audit-log.md) in Payments and billing
- ACC-31 [Show people their own security log](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/security-activity-log.md) in Accounts and identity
- APS-26 [Collect reports of blocked content](https://agentwranglers.se/playbook/application-security/browser-security-headers/reporting-endpoints.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/security-logging">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep private data out of logs and addresses](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/private-data-out-of-logs.md)
- Next: [Fix each finding within the time its severity allows](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/fix-deadlines.md)
- [Errors, logs and vulnerabilities](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities.md)