As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected.
I do my best to not log such data (although I have two levels of logs: normal and secure, and would use the secure log area for such), I am wondering whether an application is expected to still not log customer data when in debug or trace mode. All those logs happen on the server side. The client has no control over it.
In my current implementation, the normal release mode would not do so in INFO, WARNING, or ERROR log levels, but the DEBUG/TRACE levels might leak some of that information to the logs. Is that expected behavior in most website servers? Or should we attempt to limit such leaks even when in DEBUG, TRACE mode? (note that our C++ application is compiled in release mode, the "DEBUG" in this case references the log level and not whether some debug code is still in the software.)
Note that the application can be logging the data on another computer or even a third party system so security wise access to the logs is independent of access to the website server application or the database where, obviously, the data lays for sure. However, I can imagine some people having lower security requirements on their log computers than the computers with the database...