If you discover a security vulnerability in go-logger, please report it by emailing:

security@[your-domain].com or create a private security advisory on GitHub.

Please do NOT open a public issue for security vulnerabilities.

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if available)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Based on severity
  • Critical: 24-48 hours
  • High: 1 week
  • Medium: 2 weeks
  • Low: Next release

import (
    "github.com/olegiv/go-logger"
)

cfg := logger.Config{
    Level:      "warn",           // Only warnings and errors
    LogDir:     "/var/log/myapp", // Dedicated directory
    Filename:   "app.log",
    MaxSizeMB:  50,
    MaxBackups: 10,
    Console:    false,            // No console output
    DirMode:    0750,             // Restrictive permissions
}

log := logger.New(cfg)

cfg := logger.Config{
    Level:      "debug",
    LogDir:     "./logs",
    Console:    true,
    DirMode:    0750,
}

log := logger.New(cfg)

Always use absolute paths or validate relative paths:

// GOOD: Absolute path
cfg := logger.Config{
    LogDir: "/var/log/myapp",
}

// GOOD: Validated relative path
cfg := logger.Config{
    LogDir: "./logs",
}

// BAD: User-controlled path without validation
cfg := logger.Config{
    LogDir: userInput,  // NEVER DO THIS
}

Use restrictive permissions for sensitive logs:

// Maximum security (owner only)
cfg := logger.Config{
    DirMode: 0700,  // rwx------
}

// Balanced (owner + group)
cfg := logger.Config{
    DirMode: 0750,  // rwxr-x---
}

// Less secure (world-readable)
cfg := logger.Config{
    DirMode: 0755,  // rwxr-xr-x (not recommended)
}

Never log sensitive information:

// BAD - Don't do this!
log.Info().
    Str("password", user.Password).           // NEVER log passwords
    Str("api_key", apiKey).                   // NEVER log API keys
    Str("credit_card", card.Number).          // NEVER log PII
    Str("ssn", user.SSN).                     // NEVER log SSN
    Msg("User login")

// GOOD - Log safely
log.Info().
    Str("username", user.Username).           // OK: username
    Str("user_id", user.ID).                  // OK: user ID
    Str("ip_address", hashIP(r.RemoteAddr)).  // OK: hashed IP
    Msg("User login")

Always sanitize user input before logging:

import "strings"

func sanitizeForLog(input string) string {
    // Remove control characters
    input = strings.Map(func(r rune) rune {
        if r < 32 || r == 127 {
            return -1
        }
        return r
    }, input)

    // Truncate long inputs
    if len(input) > 200 {
        input = input[:200] + "...[truncated]"
    }

    return input
}

log.Info().
    Str("user_input", sanitizeForLog(userInput)).
    Msg("Processing request")

None reported as of 2026-03-29.

• None (first release)

Last security audit: 2026-03-29

Audit findings available in:

• security-audit-summary.md
• security-audit-application-code.md
• security-audit-dependencies.md
• security-audit-configuration.md

• zerolog v1.35.1 - No known vulnerabilities
• lumberjack.v2 v2.2.1 - No known vulnerabilities (unmaintained)

We use the following tools to monitor dependencies:

• govulncheck (Go official vulnerability scanner)
• GitHub Dependabot
• GitHub Security Advisories

This library supports compliance with:

• PCI-DSS: Requirement 10 (Logging and Monitoring)
• HIPAA: Security Rule (Audit Controls)
• GDPR: Article 32 (Security of Processing)
• SOC 2: Logging and Monitoring Controls

1. Encrypt logs at rest - Use filesystem encryption
2. Restrict access - Use DirMode 0700 or 0750
3. Rotate logs - Configure MaxBackups and MaxAge
4. Monitor access - Use file integrity monitoring
5. Backup logs - Implement log backup procedures

When using go-logger in production:

• Use restrictive directory permissions (0750 or 0700)
• Never log passwords, API keys, or PII
• Validate all configuration inputs
• Use absolute paths or validated relative paths
• Enable log compression for space efficiency
• Configure appropriate MaxAge for retention
• Implement log backup procedures
• Monitor for unauthorized access
• Regularly update dependencies
• Review logs for sensitive data leaks
• Implement log encryption if required
• Set up alerts for security events

For security concerns, contact:

• Email: security@[your-domain].com
• GitHub: https://github.com/olegiv/go-logger/security/advisories

We appreciate security researchers who responsibly disclose vulnerabilities.

Hall of Fame:

• (None yet)

This security policy is reviewed quarterly and updated as needed.

Last updated: 2026-03-29