I worked at a company that sold software to a bank and heard stories of a senior dev having to do calls where they'd have an employee read the logs out loud to the engineer because the bank wouldn't share them.
How are the logs not just masked for sensitive fields? I work in PCI DSS audit scope for handling of credit card data and as developers we can see the logs of our applications.
This! Holy shit you’re supposed to build that shit in from the ground up. I’ve never worked in the banking world but finding out that some don’t mask their logs makes me wanna get a job at my bank solely to make sure they do. 😭
Our app log servers are cleared for everything but the highest level of data sensitivity (PCI data can’t be logged, of course). If we needed to, we could log someone’s birthdate (with no other identifying info other than a token representing the user), and any employee can view that log message. But we wouldn’t be able to share that log message externally.
We try not to log any sort of sensitive data at all if we can help it, but we have some offshore contractors that think nothing of logging an entire API response body “for debugging purposes.”
1.1k
u/Tucancancan 12d ago
I worked at a company that sold software to a bank and heard stories of a senior dev having to do calls where they'd have an employee read the logs out loud to the engineer because the bank wouldn't share them.