Find sensitive data in log statements

Proprietary

Finds logging statements where arguments include variables, fields, or method calls with names that suggest sensitive data (passwords, tokens, SSNs, credit card numbers, etc.). Logging sensitive data can lead to information disclosure through log files (CWE-532).

org.openrewrite.java.security.search.FindSensitiveDataInLogs

Optional

Case-insensitive substrings to match against variable, field, and method names in log arguments. Defaults to common sensitive identifiers like password, token, ssn, etc. Separate values with commas.

mod run . --recipe=org.openrewrite.java.security.search.FindSensitiveDataInLogs

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.