Serguey Asael Shinder – IT Professional

I was careful about that password. Hashed in the database, encrypted in transit, never hard-coded. I did everything right — and then, in a debugging session I’d long forgotten, I’d logged the raw request object. Password included. In plain text. Sitting in a log file that had been quietly shipped to a third-party service for months.

Nothing came of it, which was luck, not skill. But the lesson landed hard: the data I’d guarded in ten places had leaked from the one place I never thought of as storage. A log feels ephemeral, like it doesn’t count. It counts. It’s a copy, written to disk, often forwarded somewhere I don’t control, frequently pasted into a ticket by someone trying to help.

Since then I treat logs as part of the attack surface, not separate from it. Before anything sensitive gets logged, I ask a blunt question: would I be comfortable handing this exact line to a stranger? If not, it gets redacted at the source, before it’s ever written.

It’s a small habit and an unglamorous one. But the safest version of a secret is the one you never wrote down in the first place — and half of writing it down happens in the logs you stopped paying attention to.

I got lucky once. I built the habit so I wouldn’t have to be lucky again.

– Serguey Asael Shinder