AI/LLM: secret or credential interpolated into a model prompt
About A09:2021 — Security Logging Failures
If you can't see attacks happening, you can't respond to them. Verizon's 2021 DBIR found that about 60% of incidents were discovered within days, but about 20% took months or more. Most apps under-log security events because logging isn't visible to users and gets cut when launch dates approach.
Impact: Without logs, you can't tell whether an incident actually happened, what data was accessed, or which accounts were compromised. Insurance providers and SOC 2 auditors will both want evidence of monitoring — its absence is a control failure.
How to fix it: Log every authentication attempt (success and failure), every authorization denial, every privilege change, every payment event. Send logs to an aggregation service (Datadog, Sentry, Logtail) that retains them. Set up alerting on suspicious patterns (e.g. 100 failed logins in 5 minutes).
Common patterns in this category:
- Auth failures logged at debug level (not retained)
- No log aggregation — logs only on the server filesystem
- PII or secrets included in error messages and shipped to log providers
- No alerting on security-relevant events
- Logs without timestamps, user IDs, or request IDs
Framework mapping
Findings from this rule map to the following framework controls. This is an informational mapping, not an audit, certification, or attestation.
See the full compliance coverage page for how every rule maps to OWASP Top 10 and CWE, and which rules also carry informational SOC 2 and ISO 27001 cross-references.
VC208 is part of the full 223-rule set on paid plans (from $19/mo)
The free, no-signup scan (paste code, upload a file, or npx xploitscan@latest scan .) runs 30 core rules.