Stack Traces Exposed in API Responses
About A09:2021 — Security Logging Failures
If you can't see attacks happening, you can't respond to them. Verizon's 2021 DBIR found that about 60% of incidents were discovered within days, but about 20% took months or more. Most apps under-log security events because logging isn't visible to users and gets cut when launch dates approach.
Impact: Without logs, you can't tell whether an incident actually happened, what data was accessed, or which accounts were compromised. Insurance providers and SOC 2 auditors will both want evidence of monitoring — its absence is a control failure.
How to fix it: Log every authentication attempt (success and failure), every authorization denial, every privilege change, every payment event. Send logs to an aggregation service (Datadog, Sentry, Logtail) that retains them. Set up alerting on suspicious patterns (e.g. 100 failed logins in 5 minutes).
Common patterns in this category:
- Auth failures logged at debug level (not retained)
- No log aggregation — logs only on the server filesystem
- PII or secrets included in error messages and shipped to log providers
- No alerting on security-relevant events
- Logs without timestamps, user IDs, or request IDs
Framework mapping
Findings from this rule map to the following framework controls. This is an informational mapping, not an audit, certification, or attestation.
See the full compliance coverage page for how every rule maps to OWASP Top 10 and CWE, and which rules also carry informational SOC 2 and ISO 27001 cross-references.
Scan your code for VC037
Free, no signup: paste code or upload a file, or run npx xploitscan@latest scan . The free scan runs 30 core rules; paid plans run all 223.