logging-securitylisted

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/logging-security/SKILL.md. --> # Logging Security Prevent secret/PII leaks in logs, log-injection attacks, missing audit trails, weak retention ## ALWAYS - Log in a **structured format** (JSON or logfmt) with stable field names. Include `timestamp`, `service`, `version`, `level`, `trace_id`, `span_id`, `user_id` (when authenticated), `request_id`, `event`. - Run every log message through a **redactor** before it reaches the log sink: passwords, tokens, API keys, cookies, full URLs containing `?token=`, common PII patterns (SSN-like, credit-card-like, email optionally). - Sanitize newlines / control characters from any user-controlled string before logging it (CWE-117): replace `\n`, `\r`, `\t` so an attacker can't inject fake log lines. - Log security-relevant events as **immutable audit records**: login success/failure, MFA challenges, password change, role change, access grant/revoke, data export, admin action. Audit records get longer retention and stricter access. - Set retention per data category, not globally: short for debug, long for audit, no PII after consent expires. - Ship logs to a centralized, append-only store (Cloud Logging, CloudWatch, Elastic, Loki) with read access restricted to engineering / SecOps. - Alert on missing logs from a service (silent failure) and on log volume anomalies (10