---
title: Credential reaches a log sink
description: Detects direct credential flows to console and logger sinks.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/credential-log-leakage
  md: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/credential-log-leakage.md
---

# Credential reaches a log sink

Detects direct credential flows to console and logger sinks.

| Detail | Value |
| - | - |
| Check ID | `CREDENTIAL_LOG_LEAKAGE` |
| Severity | High |
| How it runs | Deterministic scan and agent review |

***

## Vulnerable example

## app/routes/app.sync.ts

```ts
import { authenticate } from "../shopify.server";


export async function syncProducts(request: Request) {
  const { session } = await authenticate.admin(request);


  // Log sinks are copied into aggregators, tickets, and
  // screenshots. A token that reaches one is a token you have to
  // rotate.
  console.log("syncing", {
    shop: session.shop,
    accessToken: session.accessToken,
  });
}
```

***

## How to fix

Remove credentials from logs; emit only safe redacted, hashed, or boolean-derived values.

## app/routes/app.sync.ts

```ts
import { authenticate } from "../shopify.server";


export async function syncProducts(request: Request) {
  const { session } = await authenticate.admin(request);
  const { accessToken } = session;


  // Log the shape, never the value. Booleans, hashes and redacted
  // derivations keep the log useful for debugging. Derive first:
  // the scanner clears Boolean(accessToken), not
  // Boolean(session.accessToken).
  console.log("syncing", {
    shop: session.shop,
    hasToken: Boolean(accessToken),
  });
}
```

***

## Related

* [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), the command that runs this check
* [All app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)

***