Docs
FC-ANY-PII-002: PII value in log message
Log Message activity references a PII-named variable - PII may be written to plain logs.
What it detects
Log Message activity references a PII-named variable - PII may be written to plain logs. Flowcerta surfaces this finding from the active validation pipeline for supported file types and platforms.
Why it matters
PII findings matter because workflow automations regularly touch regulated identifiers, customer records, and health data. Weak auditability or unsafe logging turns ordinary bot activity into a compliance exposure.
Example violation
Log Message activity references a PII-named variable - PII may be written to plain logs.
Fix guidance
UiPath
- Mask or hash PII before logging. Use structured logging with field-level masking.
- Use platform-native assets, credentials, bounded retries, and Log Message checkpoints instead of hardcoded literals or silent failure paths.
- Revalidate the workflow after the change and confirm the finding no longer appears.
Verification steps
- Run validation again and confirm the rule no longer appears in the finding list.
- Review the changed workflow artifact directly to verify the risky pattern is gone.
- Capture the new validation result as evidence for the relevant owner or compliance review.
Compliance references
Related rules
This page is generated from the canonical Flowcerta rule registry used by validation scoring.
Browse all rule playbooks