> It's very easy to overlook such things and produce them as part of application logging/exhaust without realizing it Very true. It is a constant battle betwe

> It's very easy to overlook such things and produce them as part of application logging/exhaust without realizing it Very true. It is a constant battle between debuggability and not leaking credentials. In Erlang for example, when processes crash they dump their state, their neighbours, links to other processes, and other such useful stuff. That's very helpful, however it means it could dump credentials as well. Luckily there a custom function to format the state of a process http://erlang.org/doc/man/gen_server.html#Module:format_status-2 http://erlang.org/doc/man/gen_server.html#Module:format_stat... which helps with that. But have to implement that each process which holds credentials. Also some of those log ingesting services provide a pre-indexer credentials filtering. I know Splunk has it: http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Anonymizedata http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Anony... Of course it is better if it is filtered out before that. But it could be a safety net perhaps.