Originally published on my blog: https://blog.bajonczak.com/stop-logging-pii-a-configurable-node-js-sanitizer-logger/
Logging is one of those topics that looks harmless until it is not.
A developer adds a request object to a debug statement. A payment error includes a card number. A support workflow logs an email address, a phone number, and a bearer token because "we only need it for troubleshooting." Two months later those logs are in a SIEM, a data lake, three alert rules, and a backup nobody remembers.
That is the part that bothers me about PII in logs: the first mistake is small, but the copies multiply quietly.
So I built a small Node.js example that sanitizes data at the logging boundary:
