Suspicious PII Leakage in Logs

Problem

Your log records carry data that looks like personal or sensitive data: emails, national or tax IDs, credentials, or financial identifiers. It shows up in log bodies, log attributes, event names, and structured or embedded JSON payloads, usually because a log statement serializes a whole user object or request payload.

Insights reports where it found the data and what kind of data it looks like. The matched value itself is never stored.

This finding scores against Instrumentation Score rule LOG-003.

Impact

• Regulatory exposure: personal data in telemetry falls under GDPR, LGPD, and similar regimes, including breach-notification duties.
• The data spreads: every backend, every retention window, every export now holds a copy, readable by anyone with dashboard access.
• Cleanup after the fact is far more expensive than never emitting it.

Example

Leaking:

{"body": "login ok", "user": {"id": 42, "email": "[email protected]", "password": "hunter2"}}

Safe:

{"body": "login ok", "login.result": "success"}

How to fix

1. Find the log statements that serialize user objects, request payloads, or credentials, and log only the fields needed for troubleshooting.
2. Configure masking or redaction for sensitive fields in your logging framework.
3. Until the source is fixed, use the Collector transform processor to redact sensitive values in log bodies and attributes.

Expected gains

Personal data stops flowing into your log backend, and your compliance surface shrinks to the systems that actually need the data.

See the Insights catalog for everything Insights can detect.