Credential reaches a log sink
Detects direct credential flows to console and logger sinks.
| Detail | Value |
|---|---|
| Check ID | CREDENTIAL_LOG_LEAKAGE |
| Severity | High |
| How it runs | Deterministic scan and agent review |
Anchor to Vulnerable exampleVulnerable example
app/routes/app.sync.ts
import { authenticate } from "../shopify.server";
export async function syncProducts(request: Request) {
const { session } = await authenticate.admin(request);
// Log sinks are copied into aggregators, tickets, and
// screenshots. A token that reaches one is a token you have to
// rotate.
console.log("syncing", {
shop: session.shop,
accessToken: session.accessToken,
});
}
Anchor to How to fixHow to fix
Remove credentials from logs; emit only safe redacted, hashed, or boolean-derived values.
app/routes/app.sync.ts
import { authenticate } from "../shopify.server";
export async function syncProducts(request: Request) {
const { session } = await authenticate.admin(request);
const { accessToken } = session;
// Log the shape, never the value. Booleans, hashes and redacted
// derivations keep the log useful for debugging. Derive first:
// the scanner clears Boolean(accessToken), not
// Boolean(session.accessToken).
console.log("syncing", {
shop: session.shop,
hasToken: Boolean(accessToken),
});
}
shopify app security check, the command that runs this check- All app security checks
Was this page helpful?