Hi @YSahli187971 (Community Member)​,

Veracode Static Analysis reports CWE 201 (Insertion of Sensitive Information Into Sent Data) when it detects that potentially sensitive data is sent out of the application. The concerns being that the sent-out information might be sensitive in itself (such as credentials or private messages) or an attacker might be able to leverage the information for further attacks.

In your particular example, you send the content of variable `log` out of the application via the `OutputStream`. In the Veracode platform (in the Triage Flaws view), the flaw description should provide you with more information regarding why our Static Analysis engine thinks that this variable's content may be sensitive. You can view a particular flaw's description by clicking on its black triangle at the very left in the Triage Flaws view.

To resolve this finding, we recommend reviewing if the transfer of the sensitive data is intended and does not violate your application security policy. If it is unintended or violates your app sec policy, please discontinue sending that particular data out. Otherwise, please propose a mitigation and discuss it with your security team. You can find more information about how to propose mitigations here: https://help.veracode.com/r/improve_mitigation .

Thank you,

Florian Walter