# logging-failures

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Detects missing security event logs, logged secrets, and log injection through user input. Use when writing logging code, audit trails, error handlers that log, authentication event recording, or any code that writes security- relevant events. Also invoke when logging user inputs, API responses, or system actions that touch sensitive data.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/logging-failures ~/.claude/skills/logging-failures
```

## From README

Security Logging and Monitoring Failures Security Check (A09:2025) What this checks Protects the ability to detect and respond to attacks. Missing security event logs leave breaches undetected; logging sensitive fields creates new data-exposure vulnerabilities; CRLF injection lets attackers forge log entries. Vulnerable patterns Log statement that interpolates a credential, token, or other secret as a value Authentication failure, authorization denial, or privileged action that exits without producing a log record Log call that dumps a full request body, response, or other payload containing PII or tokens User-controlled string interpolated into a log line without CRLF/newline stripping, allowing forged log entries Unstructured string logs that a SIEM cannot reliably parse or alert on Fix immediately Flag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties: Every security-relevant decision point emits exactly one log record.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/logging-failures/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars