Remediate OWASP A09:2025 Security logging and alerting failures
ProprietaryOWASP A09:2025 describes failures to detect, escalate, and alert on active attacks. Previously A09:2021 Security Logging and Monitoring Failures, renamed in 2025 to emphasize alerting. Coverage here focuses on the code-side prerequisites for effective detection: getting errors and stack traces into the log stream so SIEMs can see them, keeping user-controlled input from being able to forge log entries, and keeping secrets and other sensitive values out of the log.
org.mod run .Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.
Recipe list
It runs these recipes, in this order.
- Find log injection vulnerabilities
- Find sensitive data in log statements
- Find secrets
- Enhances logging of exceptions by including the full stack trace in addition to the exception message
- Use logger instead of
printStackTrace() - Use logger instead of
System.outprint statements - Use logger instead of
System.errprint statements