You encrypted the database.
You rotated the keys.
You wrote the privacy page
and meant every line of it.
Then, in April,
you logged the whole request body
to debug one stubborn endpoint,
and you never took it out.
Now the promise lives in the database
and the truth lives in the logs.
This is the quiet leak.
Not a break-in.
A habit.
The token in the error message.
The full user record
in the retry warning.
The card number, masked,
except in the one code path
that logs before masking.
The password
that arrived in a field
you did not expect
and got printed
because you print everything
when something goes wrong.
Logs feel harmless
because logs feel internal.
They are not internal.
They are copied to a search cluster,
shipped to a vendor,
retained for a year
by a policy nobody remembers writing,
and readable by every engineer,
every on-call contractor,
and anyone who ever gets
a single read-only credential.
You built a vault
and then narrated its contents
into a room
with the door open.
So do the unglamorous audit.
Search your logs for the shape
of the things you are afraid of.
An at sign. A bearer prefix.
Sixteen digits in a row.
You will find something.
Everyone finds something.
Then move the fix upstream
of your own discipline.
Do not ask people to remember
to redact.
Give them a logger that cannot print
the sensitive type,
a struct whose printer
returns the word redacted,
a test that fails
when a secret appears in output.
Discipline does not survive
a bad afternoon.
Types and tests do.
And shorten the memory.
The safest record
is the one that expired last week.
Retention is not a storage setting.
It is the size of the blast
when someone else
reads your logs.
Then look one step further out.
The screenshot in the ticket.
The paste in the chat channel
that keeps everything forever.
The stack trace someone mailed
to a vendor
to prove the bug was real.
Same leak.
Different pipe.
You are careful about what you store.
Be as careful about
what you say out loud
while you work.
– Serguey Asael Shinder
Top comments (0)