Review logging for sensitive data and log injection

Check what gets logged and whether untrusted input reaches the log verbatim. Two issues: sensitive values recorded, and newline injection that forges entries.

grep -rEn "log.*(password|token|secret|authorization|cookie|card)" --include=*.{java,py,js,ts,go,rb} .
grep -rEn "log.(info|warn|error)(.*(getParameter|req.|request.)" --include=*.{java,js,ts} .

The bug logs unsanitized input.

log.info("login attempt: " + username);   // username with CRLF forges lines

Pro note: newline stripping on logged input prevents forged entries and log-based injection into downstream SIEM parsers. Confirm that auth tokens, session ids, and PII are never logged, including in exception stack traces and request dumps used for debugging.