Logs are number one for privacy violations. Pin codes, passwords, social security numbers etc. People remember to hash the data in their databases, but logs are often forgotten about, then stored and archived containing data that are illegal under many laws such as GDPR. And obviously also a security risk.
Developers most of time remember to scrub the data out of actual log messages but forget trace and rawer logged data also go into some log aggregators.
I am sure I have accidentally done it as well, though I try my hardest not to.
* Twitter: https://twitter.com/TwitterSupport/status/992132808192634881
* Monzo: https://www.zdnet.com/article/monzo-admits-to-storing-paymen...
* Github: https://www.bleepingcomputer.com/news/security/github-accide...
* Facebook: https://www.wired.com/story/facebook-passwords-plaintext-cha...