[crescentfresh]

Unrelated, but this reminded me of my very first real, salary developer job where I added logging to the web application. I remember logging failed password attempts specifically; I didn't give a second thought to simply logging the values of all form fields, seemed easiest at the time in case the developer changed the names of the fields.

It wasn't until a review by one of the senior devs that saw passwords in the log files - and with eyebrows raised asked "wth are you doing" - that it dawned on me, "oops". I'm glad that never made it out to production.

[acct1771]

Out of curiosity, did you look at the end-result log files yourself before the review?

[crescentfresh]

I did! I however did NOT fail to enter my credentials correctly locally, and the rest of the logs were filled with random forms submitted during testing.

"Yep, all looks good on my machine!".