Security Overview

DD has multi-layered security built in, fully safeguarding log security from data filtering to audit tracing.

Security Layers

Layer	Mechanism	Description
Data	Sensitive-data filtering	Auto-redact passwords, keys, etc.
Path	Path-safety validation	Prevent path-traversal and symlink attacks
Pattern	ReDoS protection	Detect dangerous regex patterns
Audit	Audit logging	Record key security events (redaction, rate-limit, violations, etc.)
Integrity	HMAC signing	Ensure logs are tamper-evident

Sensitive-Data Filtering

DD has built-in automatic sensitive-data detection and redaction:

logger, _ := dd.New(dd.Config{
    Security: dd.DefaultSecurityConfig(),
})

// The password field is auto-redacted
logger.InfoWith("login",
    dd.String("username", "admin"),
    dd.String("password", "s3cr3t"),  // Output: [REDACTED]
)

Supported custom patterns:

filter, _ := dd.NewCustomSensitiveDataFilter(
    `(?i)password\s*[:=]\s*\S+`,
    `(?i)api[_-]?key\s*[:=]\s*\S+`,
    `\b\d{16,19}\b`,  // Credit card number
)

See Security Filtering API.

Path Security

FileWriter has multi-layered path-safety validation built in:

Protection	Description
Path traversal	Reject ../ and similar traversal
Null bytes	Reject null-byte injection
Overlong encoding	Detect UTF-8 overlong encoding
Symlinks	Configurable symlink rejection
Hardlinks	Configurable hardlink rejection
Path length	Cap maximum path length

// Path-traversal attack auto-rejected
fw, err := dd.NewFileWriter("../../../etc/passwd", dd.DefaultFileWriterConfig())
// err.Error(): "path traversal detected"

Compliance Configuration

DD provides industry-compliance presets:

Preset	Compliance Standard	Industry
HealthcareConfig()	HIPAA	Medical
FinancialConfig()	PCI-DSS	Financial
GovernmentConfig()	Government standard	Public sector

// HIPAA compliance
logger, _ := dd.New(dd.Config{
    Security: dd.HealthcareConfig(),
})

Audit Logging

All security events can be tracked via audit logging:

audit, _ := dd.NewAuditLogger(dd.DefaultAuditConfig())
defer audit.Close()

audit.LogSecurityViolation("sql_injection", "SQL injection", map[string]any{
    "input": "' OR 1=1 --",
})

See Audit Logging API.

Log Integrity

HMAC signing ensures logs cannot be tampered with:

cfg, _ := dd.DefaultIntegrityConfigSafe()
signer, _ := dd.NewIntegritySigner(cfg)
signature := signer.Sign(logMessage)
// On verification: signer.Verify(signedEntry)

See Integrity Signing API.

Next Steps

• Production Checklist -- Pre-launch security checks
• Security Filtering API -- SensitiveDataFilter in depth
• Audit Logging API -- AuditLogger in depth