CD-SEC-10 - Security Logging and Monitoring Failures
Citizen-built apps swing between no logging at all or debug-level over-logging left on in production.
Intent & Description
'
🎯 Intent
Implement appropriate logging and monitoring for citizen-built applications without exposing sensitive data.
📋 Context
Citizen-built apps swing between two failure extremes — no logging at all (so an incident can’t be reconstructed) or debug-level over-logging left on in production (so logs themselves become a sensitive-data exposure). AI-generated integrations often fall into the second trap by default, logging raw payloads “for visibility” without redaction.
💡 Solution
Use platform-native audit logging wherever available. Instrument custom logging only where necessary. Configure platforms to avoid capturing raw application data in logs. Implement log-scrubbing rules for known sensitive-field patterns. Centralize logs for monitoring and incident response. Apply retention policies.'
Real-world Use Case
Source
📌 TL;DR
Implement balanced logging. Use platform-native audit logs, avoid over-logging, scrub sensitive data, and centralize for monitoring.
Advantages
- Enables incident detection
- Prevents log data exposure
- Supports forensic analysis
- Improves security visibility
Disadvantages
- Log storage costs
- Scrubbing rule maintenance
- Platform configuration complexity