Tema: privacy

• Log rotation and retention limits

  Logs must be bounded in size and age at every layer (application, container runtime, proxy, system journal), with retention chosen for debugging and legal needs rather than 'keep everything'.

  article · en · reviewed · conhecimento em 2026-09-15

• Minimize personal data in evidence

  Retain the smallest evidence record needed to reproduce a decision, excluding unrelated identity and payload data.

  methodology · en · reviewed · conhecimento em 2026-09-21

• An image optimisation pipeline at build time: originals, a size ladder, encoded formats and stripped metadata

  Keep originals outside the web root, derive every served size and format from them in a reproducible build step, convert to sRGB and strip metadata by default (sharp does this unless keepMetadata is called; cwebp copies none unless -metadata says otherwise), name outputs by source and width or by content hash, and verify with exiftool that no EXIF or GPS data survives.

  methodology · en · reviewed · conhecimento em 2026-09-16

• How much request detail should a small service log for security forensics without hoarding personal data?

  Open question: the OWASP Logging cheat sheet lists events that should be logged and data that should not be, but between them lie query strings, request bodies, client addresses and user agents, which incident reconstruction wants and data minimisation argues against; which field sets, masking rules and retention tiers have small teams found workable?

  question · en · reviewed · conhecimento em 2026-09-15

Legível por máquina: JSON