Warn about sensitive information in logs

Glyn Normington · Glyn Normington · commit 7b817d71ee04 · 2013-08-14T14:35:34.000+01:00
Add a new Security page and link to that from the README to attract
people's attention. In the Security page, link to the logging section
on sensitive information in logs.

Also mention on the security page the need to keep any forks up to
date.

[#54989128]
diff --git a/README.md b/README.md
@@ -16,6 +16,7 @@ The buildpack supports configuration and extension through the use of Git reposi
 ## Additional Documentation
 * [Design](docs/design.md)
 * [Migrating from the Previous Java Buildpack](docs/migration.md)
+* [Security](docs/security.md)
 * Standard Containers
 	* [Groovy](docs/container-groovy.md) ([Configuration](docs/container-groovy.md#configuration))
 	* [Java Main Class](docs/container-java-main.md) ([Configuration](docs/container-java-main.md#configuration))
diff --git a/docs/logging.md b/docs/logging.md
@@ -8,6 +8,15 @@ If the buildpack fails with an exception, the exception message is logged with a
 log level of `ERROR` whereas the exception stack trace is logged with a log
 level of `DEBUG` to prevent users from seeing stack traces by default.
 
+## Sensitive Information in Logs
+
+The Java buildpack logs sensitive information, such as environment variables which may contain security
+credentials.
+
+_You should be careful not to expose this information
+inadvertently_, for example by posting standard error stream contents or the contents of
+`<app dir>/.buildpack-diagnostics/buildpack.log` to a public discussion list.  
+
 ## Logger Usage
 The `LoggerFactory` class in the `JavaBuildpack::Diagnostics` module
 manages a single instance of a subclass of the standard Ruby `Logger`.
diff --git a/docs/security.md b/docs/security.md
@@ -0,0 +1,13 @@
+# Security
+
+In addition to security considerations associated with JREs, containers, and frameworks, the
+following points pertain to the security of the buildpack itself.
+
+## Buildpack Forks
+
+If you fork the Java buildpack, it is important to keep the fork up to date with the
+original repository. This will ensure that your fork runs with any security fixes that may be necessary.
+
+## Security and Logs
+
+See [Sensitive Information in Logs](logging.md#Sensitive-Information-in-Logs).
