Description

This detector identifies JavaScript code that logs sensitive information using the Pino logging library. Logging sensitive data like passwords, tokens, or personal information can lead to security breaches if logs are compromised or accessed by unauthorized parties.

Detection Strategy

• Scans JavaScript source code for Pino logging library usage

• Identifies logging statements that may contain sensitive information such as passwords, API keys, tokens, or personal data

• Triggers when Pino logging methods are called with parameters that could expose sensitive information

• Reports vulnerabilities when sensitive data patterns are detected in log output statements

Vulnerable code example

const pino = require('pino');
const logger = pino();

const apiKey = "sk-1234567890abcdef";
logger.info(apiKey); // VULNERABLE: sensitive data exposed in logs

const password = "user123pass";
logger.error("Auth failed: " + password); // VULNERABLE: concatenated sensitive data logged

✅ Secure code example

const pino = require('pino');
const logger = pino();

const apiKey = "sk-1234567890abcdef";
logger.info("API key configured successfully"); // SECURE: log event without exposing key value

const password = "user123pass";
logger.error("Authentication failed for user"); // SECURE: log error without exposing password