> Explicitly logging a password is one of those practices that doesn't sit on the backlog. If that is your experience, then that's a truly wonderful thing. M

> Explicitly logging a password is one of those practices that doesn't sit on the backlog. If that is your experience, then that's a truly wonderful thing. Might it be possible that at many companies, teams with deadlines to hit will tend to prioritize feature work over details like this? Perhaps especially so when teams are not rewarded for fixing vulnerabilities and are punished for not meeting deadlines? Particularly when the actual bug at hand is that the full contents of a POST are being logged, and a PM might not read the ticket enough to understand that this includes a password... Again, you're completely right in every way about what should happen. It just could be possible that this could reflect something other than all experiences all software engineers have had.