No `if (false)` / `if (true)` debug blocks

if (false) blocks are code that never executes — AI commonly uses them to 'disable' logic without deleting it, leaving dead branches that confuse static analysis, obscure actual code paths, and make security reviews unreliable. if (true) debug toggles expose internal state (request bodies, database rows, session tokens) to logs that may be shipped to log aggregators, error trackers, or observability platforms. CWE-489 (Active Debug Code) applies: these patterns signal that the code was never cleaned up after prototyping and likely contains other unfinished logic nearby.

Delete if (false) blocks entirely — they are dead code with no runtime value. For if (true) debug toggles, replace them with environment-gated flags in src/lib/logger.ts or equivalent:

// Remove these:
if (false) { doOldThing() }
if (true) { console.log('debug:', sensitiveData) }

// Replace debug logging with:
if (process.env.DEBUG === 'true') {
  console.log('debug:', safeToLogData)
}

// Or use a structured logger that respects log level:
import { logger } from '@/lib/logger'
logger.debug({ event: 'auth-check', userId }) // no raw data

Search non-test source files for the literal strings if (false), if(false), if (true), if(true) and remove every match.