If errors must be tracked in some detail, capture them in log messages - but consider
what could occur if the log messages can be viewed by attackers. Avoid recording highly
sensitive information such as passwords in any form. Avoid inconsistent messaging that
might accidentally tip off an attacker about internal state, such as whether a username is