agentsclimarketplace

Logging security

Skill ShieldNet-360/secure-vibe/dist/copilot-skills/.github/skills/logging-security

SecureVibe — prevention-first security for AI-written code. Signed SKILL.md knowledge that makes AI coding assistants write secure code at generation time, plus a deterministic CI gate. Offline · keyless · Ed25519-signed. By ShieldNet360.

Install
npx -y skills add ShieldNet-360/secure-vibe --skill logging-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Prevent secret/PII leaks in logs, log-injection attacks, missing audit trails, weak retention — Applies to: when generating logger calls or structured-logging schemas; when wiring log shippers, sinks, retention, and access controls; when reviewing requirements for audit logging

SKILL.md

3.5 KB, as published. Nobody here has run it

<!-- Native skill bundle for GitHub Copilot. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/logging-security/SKILL.md. -->

Logging Security

Prevent secret/PII leaks in logs, log-injection attacks, missing audit trails, weak retention

ALWAYS

  • Log in a structured format (JSON or logfmt) with stable field names. Include timestamp, service, version, level, trace_id, span_id, user_id (when authenticated), request_id, event.
  • Run every log message through a redactor before it reaches the log sink: passwords, tokens, API keys, cookies, full URLs containing ?token=, common PII patterns (SSN-like, credit-card-like, email optionally).
  • Sanitize newlines / control characters from any user-controlled string before logging it (CWE-117): replace \n, \r, \t so an attacker can't inject fake log lines.
  • Log security-relevant events as immutable audit records: login success/failure, MFA challenges, password change, role change, access grant/revoke, data export, admin action. Audit records get longer retention and stricter access.
  • Set retention per data category, not globally: short for debug, long for audit, no PII after consent expires.
  • Ship logs to a centralized, append-only store (Cloud Logging, CloudWatch, Elastic, Loki) with read access restricted to engineering / SecOps.
  • Alert on missing logs from a service (silent failure) and on log volume anomalies (10x spike or 10x drop).

NEVER

  • Log full request / response bodies at INFO. Bodies regularly contain passwords, tokens, PII, and uploaded files.
  • Log Authorization headers, Cookie / Set-Cookie headers, query-string tokens, or any field named password, secret, token, key, private, or credential — even after "obfuscation" like ***.
  • Log a rendered / assembled string (a formatted notification body, a templated message, an error with interpolated data) trusting a field-name / pattern redactor to catch it — PII (names, places, free-text addresses) sits inside the composed text, not in a named field or a known pattern. Log a non-sensitive reference / id instead, or redact the composed value by content.
  • Log entire bound SQL statements with their parameter values; log the statement template + parameter names + a hashed value identifier instead.
  • Allow unprivileged users to read raw logs containing other users' data.
  • Use plain print() / console.log / fmt.Println in production services; use the configured logger so redaction and structure are applied uniformly.
  • Disable logging of failed authentication attempts to "reduce noise" — brute-force detection depends on those records.
  • Log to a single file on local disk in production; logs there are lost when the pod / container / VM dies.

KNOWN FALSE POSITIVES

  • Health-check or load-balancer probe logs can legitimately be downsampled / suppressed at the load balancer to save volume.
  • A request_id value that happens to look like a token is not a token — redactors that match patterns can over-redact; whitelist known-safe prefixes (your req_ correlation IDs, for example).
  • Anonymous public-API access logs without auth headers are not a privacy issue per se; client IPs may still be PII under GDPR.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.