A format string in a TRACE logger can read the process environmentPassing a request line to snprintf as its format string turns logging into memory disclosure. Use a constant format and keep secrets out of process memory.6 October 2026·3 mins