Skip to content

secrets

Logging the request

Where a credential outlives the request that carried it.

Logging the whole request body is the most useful thing you can do while debugging a sign-in flow and the worst thing you can leave in. A password lives for the length of a request; a log line lives for as long as your retention policy says, on a system with a completely different set of people who can read it.

The response here is identical on both builds. The only difference is a line nobody sees until an incident, which is exactly why this one survives review.

  • POST /session

    Identical responses. Open the log pane and compare what each build wrote.

Log the identifier, never the credential. The user id tells you which sign-in this was; the password tells you nothing you needed and everything somebody else wants.

The engine holds a registry of this build's secrets and records whenever one of them turns up in a response body, a header, a cookie or a log line — stamped as it happens, so the finding names the call that leaked it rather than the place somebody later noticed.

This build

shop.example.com

Nothing sent yet. Every request goes to the application in this tab and nowhere else.