Home / Help centre / Security & privacy
Security & privacy
Do Cyberlop's application logs contain my tokens or cookies?
No. The Security page says Cyberlop’s application logs redact tokens, cookies and credentials. Stored secrets are encrypted and never shown again, session and API tokens are kept only as hashes, and Git tokens go to git per call without touching disk.
The short version
Logs should help engineers fix problems without handing out keys. Cyberlop redacts tokens, cookies and credentials before they can land in application logs.
| Item | Protection |
|---|---|
| Tokens in logs | Redacted |
| Cookies in logs | Redacted |
| Credentials in logs | Redacted |
| Session and API tokens at rest | Stored only as hashes |
| Git tokens | Passed to git per call, never written to disk |
How it works in Cyberlop
Secrets can leak through ordinary places such as an error line or a request trace. That is why the Security page names logs on its own list of controls. Application logs redact tokens, cookies and credentials, so secrets stay out of the text that people read.
Logs are one of several layers. Cyberlop encrypts the stored credentials, shows the raw value of a new session or API token once, and keeps only a hash afterwards. The profile YAML preview also leaves out secrets: the API reference describes it as the generated scanner config with no secrets.
Your own systems matter too. Reports hold evidence such as requests and responses from your app. Treat them like any security document and share them with care. Read secrets management for habits that help.
What to do next
- Read the full list in how Cyberlop stores your credentials.
- Learn about why the YAML preview hides secrets.
- See how Git tokens stay protected.
Need an answer for an audit? Contact us at /contact.
Related questions
- How does Cyberlop store my credentials and tokens?
- Why doesn't the YAML preview show my passwords or tokens?
- Could my Git token be sent to a repository host I don't control?
- How are sign-in sessions secured?
- Can Cyberlop staff see my source code?
Account and organisation settings: notifications, retention, logo and plan
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Security question we did not answer?
Our team will answer it directly, or walk through it on a call with your security lead.