At least one? Almost every one of the recent "plaintext password" headlines, of which there has been half a dozen or more, were due to that. And I'm sure there

At least one? Almost every one of the recent "plaintext password" headlines, of which there has been half a dozen or more, were due to that. And I'm sure there are many more cases happening right now without being noticed. It definitely is big issue. And no, I don't think in most cases it's forgetting to remove the `console.log(req.body.password)`, but rather having a much wider `console.log(req)` which you didn't realize contains (or could in some other code path contain) a password. Or some log statement much deeper, 2-3 layers of abstractions away, logging some struct passing through the system, which happens to contain PII. It definitely isn't a trivial issue with a simple solution, as some people commenting on such headlines seem to imply.