title: Passwords in the clear in logs
body: <p>I am aware that there are a number of reasons why passwords CAN end up in logs in the clear - for instance, I see this mentioned in the context of debug logs with some frequency - but I was wondering if someone could explain the mechanics of how this works assuming a web application hashes passwords that are submitted by a user and compares the hash to the one stored by the site operator. </p>
  
  <p>For instance, let's say a user goes to a website, enters a username and password, and clicks submit. I would have assumed that the password is immediately hashed (let's say with bcrypt) and compared to the hash associated with the entered username in a database. How, then, would the plaintext password end up in a log? Does the entered password somehow get logged before the hashing takes place? And if so, is that a security failure?</p>