Secure Error Logging Practices to Prevent Information Leaks Across Java, Kotlin, JavaScript and Python
Error logging forms a critical part of the software development lifecycle, aiding debugging and early detection of failures. However, logs must remain both informative and secure to avoid unintended information disclosure.
The article, written by Natalia Noyanova of T1 IT Holding, draws on years of experience in information security and static code analysis. It highlights how code analyzers flag internal or external information leaks tied to error logging and explains why fixing these issues requires more than simple code changes.
Logging levels range from DEBUG (detailed diagnostic data not used in production) through INFO, WARNING, ERROR to FATAL (critical errors that halt the application). Recording mechanisms include plain text files, multi-stage logs requiring special readers, binary formats and databases.
Trace ID provides a unique technical identifier generated at the API gateway for each incoming request and propagated unchanged through all microservices. Correlation ID links multiple technical requests that belong to one business transaction, such as an order placement involving inventory, payment and confirmation steps.
Examples of exploitation include Flask applications running with debug=True that return full stack traces revealing absolute paths like /app/main.py and Python interpreter versions. Similar leaks occur when developers manually return traceback.format_exc() or forward raw SQLite errors after failed queries, confirming the database engine and aiding SQL injection refinement.
Prevention measures cover removal of X-Powered-By and Server headers via Nginx server_tokens off, input sanitization with regular expressions to block newlines in trace identifiers, and adoption of OpenTelemetry for automatic generation of safe hex-formatted trace IDs. Structured JSON logging further isolates fields and prevents log injection attacks described under CWE-117.
Related articles
Apple Releases macOS Updates to Fix CoreGraphics Vulnerability Possibly Exploited in Targeted iOS Attacks
Apple has issued security updates for multiple macOS versions to address a serious vulnerability in the CoreGraphics framework. The flaw, tracked as CVE-2026-86950, involves an out-of-bounds write that could allow arbitrary code execution when processing specially crafted files. The company also noted that the same issue may have been exploited in sophisticated, targeted attacks against older versions of iOS. CISA assigned the vulnerability a CVSS v3.1 base score of 8.8, classifying it as High severity. Patches are now available in macOS Tahoe 26.7.1, macOS Sequoia 15.8.1, and the latest macOS Golden Gate 27.0.1 release.
Apple Releases iOS 26.7.1 and iPadOS 26.7.1 to Fix CoreGraphics Vulnerability Possibly Exploited in Targeted Attacks
Apple has issued iOS 26.7.1 and iPadOS 26.7.1 to address a high-severity vulnerability in the CoreGraphics framework. The flaw, tracked as CVE-2026-86950, could allow arbitrary code execution when processing a specially crafted file due to an out-of-bounds write. The company stated that the issue may have been exploited in sophisticated, targeted attacks against specific individuals on versions prior to iOS 27. CISA assigned the vulnerability a CVSS v3.1 base score of 8.8, classifying it as High severity. On the same day, Apple also released iOS 27.0.1 and iPadOS 27.0.1, though those updates did not reference CVE-2026-86950. The patches close a vector that could be abused for remote code execution in image rendering components.
Fundamental Flaw in File Monitoring APIs Exposes Keystrokes and App Activity Across Windows, Linux, Android, and macOS
Researchers from Graz University of Technology demonstrated how built-in file change notification mechanisms can leak sensitive user activity without requiring elevated privileges. The affected subsystems include inotify on Linux, FileObserver on Android, ReadDirectoryChangesW on Windows, and FSEvents on macOS. On Linux the technique enables reconstruction of typed text with 93-100% accuracy by monitoring /dev/input/event4 timestamps. Android apps can break sandbox isolation to observe messaging events, while Windows monitoring of browser cache files reveals visited websites at 97.8% accuracy. Only partial mitigations have been deployed in Linux and Windows, with no fixes available for Android or macOS. Additional attacks remain possible, including detection of password prompts to facilitate phishing overlays.
16-Year-Old Researcher Discovers Authentication Bypass in Microsoft Titan Analytics Platform
A 16-year-old security researcher using the pseudonym Faav identified a critical flaw in Microsoft Titan, the company's internal analytics platform. The vulnerability allowed an attacker to submit forged JSON Web Tokens that bypassed signature verification and granted administrator privileges. With these rights, the researcher could execute arbitrary SQL queries against connected databases containing metadata from nearly 10,000 tables. Microsoft received the report on September 5, disabled public API access four days later, and issued a $5,000 bounty on September 17. No evidence has emerged that the issue was exploited by malicious actors before remediation. The researcher accessed only limited metadata and a small number of records during testing and did not exfiltrate customer personal data.