Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Our application stored **e.printstacktrace()** in a log file, which is accessible to a specific user group. We need such detailed information for debugging purposes.
As per the security team, they are requesting us to remove such detailed system information from the log file, so here my question is about how it will affect the security of the application.
Logging stack traces to a log file is in itself usually not a security issue, but the exposure of information in the log file can be, depending on your threat model, the information contained in the backtraces and the specific user group in question.
One example of a case where stack traces might contain sensitive information is if they could cause user credentials or other PII to be logged for your developers to see, who should not otherwise have access to this information. Another problem might be if the stack traces are exposed to a potential attacker, who may use the leaked information (e.g. pointer values) to circumvent mitigations such as ASLR.
If your security team is asking you to remove that information, I'd suggest you work with them to figure out what information exposure they are concerned about, which threat model applies, and how you can keep the same level of insight without compromising on your security.
