[lhnz]

Why not automate this?

Create a user with an extremely unusual password and create a script that logs them in once an hour. Use another script to grep the logs for this unusual password, and if it appears fire an alert.

Security reviews are important but we should be able to automate detection of basic security failures like this.

[actsasbuffoon]

It would also be a good idea to search for the hashed version of that user’s password. It’s really bad to leak the unencrypted password when it comes in as a param, but it’s only marginally better to leak the hashed version.

[sumeno]

This only works if you automate every possible code path. If you're logging passwords during some obscure error in the login flow then an automated login very likely won't catch it.

[lhnz]

True, but it is more effective than doing nothing.

[jazzdev]

But it's not a choice of doing this or nothing. It's a choice of doing this or something else. That something else may be a better use of your time.