# ❌ VULNERABLE: Logging passwords
import logging
logger = logging.getLogger(__name__)

def authenticate(username, password):
    logger.info(f"Login attempt: {username} with password {password}")  # Exposed!

# ❌ VULNERABLE: Logging API keys
logger.debug(f"API request with key: {api_key}")  # Exposed!

# ❌ VULNERABLE: Logging full request
logger.info(f"Request: {request.body}")  # May contain secrets

# ✅ SECURE: Redact sensitive data
import logging
import re

class SensitiveDataFilter(logging.Filter):
    def filter(self, record):
        # Redact patterns
        record.msg = re.sub(r'password["\s:=]+\S+', 'password=***REDACTED***', str(record.msg), flags=re.IGNORECASE)
        record.msg = re.sub(r'api[_-]?key["\s:=]+\S+', 'api_key=***REDACTED***', str(record.msg), flags=re.IGNORECASE)
        record.msg = re.sub(r'token["\s:=]+\S+', 'token=***REDACTED***', str(record.msg), flags=re.IGNORECASE)
        return True

logger = logging.getLogger(__name__)
logger.addFilter(SensitiveDataFilter())

def authenticate(username, password):
    logger.info(f"Login attempt: user={username}")  # No password logged
    result = check_credentials(username, password)
    if result:
        logger.info(f"Successful login: user={username}, ip={request.remote_addr}")
    else:
        logger.warning(f"Failed login: user={username}, ip={request.remote_addr}")

// ❌ VULNERABLE: CRLF injection
const logger = require('winston');

app.post('/login', (req, res) => {
  logger.info(`Login attempt: ${req.body.username}`);  // CRLF injection!
  // Attacker sends: username="admin\nPASSWORD: secret123"
});

// ❌ VULNERABLE: Log forging
logger.info(`User action: ${userInput}`);  // Can inject fake log entries

// ✅ SECURE: Structured logging with sanitization
const winston = require('winston');

const logger = winston.createLogger({
  format: winston.format.json(),  // Structured logging prevents injection
  transports: [
    new winston.transports.File({ filename: 'app.log' })
  ]
});

function sanitizeLogInput(input) {
  if (typeof input !== 'string') return input;
  // Remove CRLF and control characters
  return input.replace(/[\r\n\t]/g, ' ').substring(0, 1000);
}

app.post('/login', (req, res) => {
  logger.info({
    event: 'login_attempt',
    username: sanitizeLogInput(req.body.username),
    ip: req.ip,
    timestamp: new Date().toISOString()
  });
});

// ❌ VULNERABLE: No security event logging
public void updateUserRole(String userId, String newRole) {
    userRepository.updateRole(userId, newRole);  // No logging!
}

// ❌ VULNERABLE: Insufficient context
logger.info("User role updated");  // Who? When? What role?

// ✅ SECURE: Comprehensive security event logging
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.slf4j.MDC;

public class UserService {
    private static final Logger securityLogger = LoggerFactory.getLogger("SECURITY");

    public void updateUserRole(String userId, String newRole, String adminId) {
        String oldRole = userRepository.getRole(userId);

        // Set context
        MDC.put("event_type", "authorization_change");
        MDC.put("admin_id", adminId);
        MDC.put("target_user_id", userId);
        MDC.put("ip_address", getClientIp());

        try {
            userRepository.updateRole(userId, newRole);

            // Log successful change
            securityLogger.info(
                "Role changed: user={} old_role={} new_role={} admin={} ip={}",
                userId, oldRole, newRole, adminId, getClientIp()
            );
        } catch (UnauthorizedException e) {
            // Log authorization failure
            securityLogger.warn(
                "Unauthorized role change attempt: admin={} target_user={} ip={}",
                adminId, userId, getClientIp()
            );
            throw e;
        } finally {
            MDC.clear();
        }
    }

    public void login(String username, String password) {
        try {
            User user = authenticate(username, password);

            securityLogger.info(
                "Successful login: user={} ip={} user_agent={}",
                user.getId(), getClientIp(), getUserAgent()
            );
        } catch (AuthenticationException e) {
            securityLogger.warn(
                "Failed login attempt: username={} ip={} reason={}",
                username, getClientIp(), e.getMessage()
            );
            throw e;
        }
    }
}

# ❌ VULNERABLE: Logs can be tampered with
import logging
logging.basicConfig(filename='app.log', level=logging.INFO)
# File permissions allow modification

# ❌ VULNERABLE: No integrity verification
logger.info("Security event")  # Can be modified later

# ✅ SECURE: Append-only logs with integrity checks
import logging
import hmac
import hashlib
import os
from datetime import datetime

class IntegrityLogger:
    def __init__(self, log_file, secret_key):
        self.log_file = log_file
        self.secret_key = secret_key

        # Create log file with restricted permissions (append-only)
        if not os.path.exists(log_file):
            open(log_file, 'a').close()
            os.chmod(log_file, 0o600)  # Owner read/write only

    def log(self, level, message, **context):
        timestamp = datetime.utcnow().isoformat()

        log_entry = {
            'timestamp': timestamp,
            'level': level,
            'message': message,
            **context
        }

        # Create integrity signature
        log_data = f"{timestamp}|{level}|{message}|{context}"
        signature = hmac.new(
            self.secret_key.encode(),
            log_data.encode(),
            hashlib.sha256
        ).hexdigest()

        log_entry['signature'] = signature

        # Append to log file
        with open(self.log_file, 'a') as f:
            import json
            f.write(json.dumps(log_entry) + '\n')

    def verify_log_integrity(self):
        """Verify all log entries haven't been tampered with"""
        with open(self.log_file, 'r') as f:
            for line_num, line in enumerate(f, 1):
                entry = json.loads(line)

                # Recreate signature
                log_data = f"{entry['timestamp']}|{entry['level']}|{entry['message']}|{entry.get('context', {})}"
                expected_sig = hmac.new(
                    self.secret_key.encode(),
                    log_data.encode(),
                    hashlib.sha256
                ).hexdigest()

                if entry['signature'] != expected_sig:
                    raise ValueError(f"Log tampering detected at line {line_num}")

# Usage
secret_key = os.getenv('LOG_INTEGRITY_KEY')
logger = IntegrityLogger('/var/log/app/security.log', secret_key)

logger.log('INFO', 'User login', user_id='12345', ip='192.168.1.100')
logger.log('WARNING', 'Failed authorization', user_id='12345', resource='admin_panel')

# Periodically verify integrity
logger.verify_log_integrity()

// ✅ SECURE: Structured logging to SIEM
const winston = require('winston');
const SyslogTransport = require('winston-syslog').Syslog;

const logger = winston.createLogger({
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.json()
  ),
  transports: [
    // Local file (backup)
    new winston.transports.File({
      filename: '/var/log/app/security.log',
      mode: 0o600  // Restricted permissions
    }),
    // SIEM integration (centralized, immutable)
    new SyslogTransport({
      host: process.env.SIEM_HOST,
      port: 514,
      protocol: 'tcp',
      facility: 'local0',
      app_name: 'web-api'
    })
  ]
});

// Security event helper
function logSecurityEvent(eventType, details) {
  logger.info({
    event_category: 'security',
    event_type: eventType,
    ...details,
    timestamp: new Date().toISOString()
  });
}

// Usage
logSecurityEvent('authentication_success', {
  user_id: user.id,
  ip_address: req.ip,
  user_agent: req.headers['user-agent']
});

logSecurityEvent('authorization_failure', {
  user_id: user.id,
  resource: '/admin/users',
  action: 'DELETE',
  ip_address: req.ip
});

// Example: Review application logging
use the .claude/agents/logging-specialist.md agent to validate logging implementation
use the .claude/agents/secrets-specialist.md agent to check for hardcoded secrets in logs
use the .claude/agents/data-protection-specialist.md agent to verify PII handling