What is Insufficient Logging?
Someone tries to log into your app with 500 different passwords in 10 minutes. Your server processes every request, returns 401 each time, and records nothing. No log entry. No alert. No way to know it happened — until the attacker gets the right password.
Insufficient logging means your app is flying blind. When something goes wrong — and it will — you have no audit trail to figure out what happened, when it started, or what data was accessed. Incident response without logs is guesswork.
The OWASP Top 10 lists this as #9: Security Logging and Monitoring Failures. It's not a direct exploit — it's the reason other exploits succeed quietly and stay undetected for weeks or months.
How does Insufficient Logging work?
The pattern is simple: your application handles security-sensitive operations but never records them. Failed logins, permission checks, data exports, admin actions — they all happen in silence.
Here's what AI-generated auth code typically looks like:
// app/api/auth/login/route.ts
export async function POST(req: Request) {
const { email, password } = await req.json();
try {
const user = await verifyCredentials(email, password);
const token = await createSession(user);
return Response.json({ token });
} catch (error) {
// Swallowed silently. No log. No record.
// An attacker could brute-force this endpoint
// and you'd never know.
return Response.json(
{ error: "Invalid credentials" },
{ status: 401 }
);
}
}// app/api/auth/login/route.ts
import { securityLog } from "@/lib/logging";
export async function POST(req: Request) {
const { email, password } = await req.json();
const ip = req.headers.get("x-forwarded-for") ?? "unknown";
try {
const user = await verifyCredentials(email, password);
const token = await createSession(user);
securityLog.info("auth.login.success", {
userId: user.id, email, ip,
});
return Response.json({ token });
} catch (error) {
securityLog.warn("auth.login.failure", {
email, ip,
reason: error instanceof Error ? error.message : "unknown",
});
return Response.json(
{ error: "Invalid credentials" },
{ status: 401 }
);
}
}Why do AI tools generate Insufficient Logging vulnerabilities?
AI code generators treat logging as noise. Their goal is working code — and working code doesn't need logs to function. The result is applications that run perfectly but record nothing about who's doing what.
- Catch blocks are for errors, not events. AI generates <code>catch (error) { return 401 }</code> because that's what tutorials show. The error is handled — just not recorded.
- Logging isn't in the prompt. "Build a login endpoint" gets you authentication logic. It doesn't get you an audit trail. You have to ask for it explicitly.
- No logging infrastructure exists yet. In a freshly generated app, there's no logging library, no log destination, no structured format. AI won't scaffold logging infrastructure unless prompted.
The irony: the apps most likely to have insufficient logging are the ones built fastest — which are also the ones most likely to ship with other security issues that logging would help catch.
Common Insufficient Logging patterns
Silent catch blocks
catch (error) { return error response } — the failure is handled but never recorded anywhere.
No auth event tracking
Login successes, failures, password resets, and session invalidations happen without any log entry.
Console.log in development, nothing in production
Development logging via console.log that gets stripped or ignored in production builds.
Missing data access logs
Sensitive data queries (user records, financial data, exports) execute without recording who accessed what.
How Flowpatrol detects Insufficient Logging
Flowpatrol checks whether your app records security events the way a production application should:
- 1Triggers authentication failures and checks whether the application logs or rate-limits repeated attempts.
- 2Tests authorization boundaries to see if access denials produce any observable logging or monitoring response.
- 3Checks for error disclosure patterns that suggest errors are being swallowed rather than logged — like generic 500s with no detail.
- 4Flags missing security headers related to monitoring, like Report-To and NEL, that indicate no client-side error reporting.
You can't fix what you can't see. Flowpatrol finds the gaps in your audit trail before they become gaps in your incident response.
Related terms
Find your logging blind spots.
Flowpatrol checks your app for silent failures, missing audit trails, and monitoring gaps. Five minutes. One URL.
Try it free