For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/static_analysis/static_analysis_rules/dart-security/clear-text-logging.md. A documentation index is available at /llms.txt.

Avoid logging sensitive data in cleartext

This product is not supported for your selected Datadog site. ().

Metadata

ID: dart-security/clear-text-logging

Language: Dart

Severity: Warning

Category: Security

CWE: 200

Description

Passing variables named password, token, secret, or key to print(), log(), or debugPrint() can expose sensitive values in device logs, crash reports, and monitoring pipelines.

Replace logging of sensitive data with redacted summaries or structured log entries that omit the raw value.

Non-Compliant Code Examples

void login(String password) {
  print(password);
}
void store(String apiToken) {
  debugPrint(apiToken);
}
void cache(String secret) {
  log(secret);
}
void debug(String token) {
  print('Current token: $token');
}
void debug(String password) {
  log('Attempting login with: $password');
}

Compliant Code Examples

void main() {
  final username = 'alice';
  print(username);
}
void main() {
  print('Login successful');
  log('Server started');
}
void main() {
  final username = 'alice';
  print('Welcome, $username');
}
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Security