T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:94
- Finding
- Sensitive Webhook Headers and Payloads Are Written to Application Logs## Vulnerability Details **File Location**: `SKILL.md:94-102` **Vulnerability Type**: Sensitive data exposure through insecure logging **Risk Level**: Medium ### Vulnerable Code ```typescript // Always log webhook events for debugging app.post('/webhook', async (req, res) => { console.log('[Webhook] Received:', { headers: req.headers, body: JSON.stringify(req.body).slice(0, 500), timestamp: new Date().toISOString(), }); // ... process }); ``` ### Technical Analysis The Skill explicitly recommends logging all webhook request headers and the first 500 characters of each request body. Payment-provider webhooks can include customer information, transaction identifiers, order metadata, email addresses, and other sensitive business data. Headers can contain webhook signatures, authorization information, cookies, tracing data, or infrastructure-specific secrets. Limiting the serialized body to 500 characters is not sanitization. Sensitive values frequently occur near the beginning of a payload and would still be recorded. The recommendation also contradicts the Skill's separate instruction not to log sensitive data. Although this repository contains documentation rather than an automatically executed server, developers following the supplied example could deploy the vulnerable logging behavior in a production payment endpoint. ### Attack Path 1. A developer copies or generates a webhook endpoint based on the Skill's debugging example. 2. The endpoint receives legitimate payment events containing customer and transaction data, or attacker-generated requests containing chosen sensitive content. 3. The endpoint records all request headers and up to 500 characters of the serialized body. 4. The records are retained in local logs or forwarded to a centralized logging service. 5. An operator, compromised logging account, support user, or attacker with read access to the logging system retrieves the e ...[truncated 763 chars]
- Remediation
- ## Remediation Suggestions - Remove the recommendation to log raw webhook headers and bodies. - Log only an allowlist of non-sensitive fields, such as provider name, event ID, event type, processing result, timestamp, and an internal correlation ID. - Never log authorization, cookie, webhook-signature, access-token, card, customer, or payment-instrument fields. - If payload diagnostics are essential, implement structured recursive redaction before logging and disable detailed payload logging in production. - Apply least-privilege access controls, encryption, short retention periods, and audit monitoring to payment-related logs. - Replace the example with a safe pattern such as: ```typescript console.log('[Webhook] Received', { provider: 'example-provider', eventId: verifiedEvent.id, eventType: verifiedEvent.type, timestamp: new Date().toISOString(), }); ```