#0705
A login service logs every authentication attempt for audit purposes — including the plaintext password supplied by the user.
Log aggregators, SIEM tools, and anyone with read access to log files can harvest credentials. A single log-pipeline misconfiguration can expose every user's password.
Log entries must record who attempted to log in and whether it succeeded, but must never include credentials.
Credentials in logs violate multiple compliance frameworks (PCI-DSS, SOC 2, GDPR). Log aggregation pipelines are frequently breached or misconfigured — once passwords land in logs, they are nearly impossible to fully purge.
logLoginAttempt so the returned log object does NOT include the password.username and success fields.hasPassword field must be false after the fix.logLoginAttempt('alice', 'hunter2', true)// → { username:'alice', success:true, hasPassword:true }
logLoginAttempt('alice', 'hunter2', true)// → { username:'alice', success:true, hasPassword:false }
{ username: string, success: boolean, hasPassword: boolean }.hasPassword must be false in the fixed version.