SOC2 Don’t leak user data

// Don't log potentially sensitive user data
console.log(user)

// Don't log potentially sensitive user data
log.info(user)

// Don't log sensitive user information like `email`
console.error('Invalid user', user.email)

// Don't log request bodies which may contain sensitive user data
log.info({ body: req.body })

// Don't expose request bodies which may contain sensitive user data
throw new Error('error', { body: req.body })

// Logging non-identifying user data such as internal IDs is fine
console.log(user.id)

// Logging non-identifying user data such as internal IDs is fine
logger.warn(`Invalid user: ${user.id}`)

// Exposing non-identifying user data such as internal IDs is fine
throw new Error(`User error ${user.id}`)

// Logging internal resources related to a user is okay
console.log(user.posts)