No console.log or console.debug in production code paths

Unguarded console.log calls in production code expose internal data structures — user objects, API responses, internal state — to browser consoles and server logs. CWE-532 (Insertion of Sensitive Information into Log File) applies when logged objects include user data, tokens, or application secrets. Beyond the data exposure risk, console.log in server-side code that runs on every request floods logs with noise, making real errors and security incidents harder to detect. AI-generated codebases accumulate debug logs that were never removed before shipping.

Add an ESLint rule to flag production console calls:

"no-console": ["warn", { "allow": ["warn", "error"] }]

Replace debug logging with a structured logger that is environment-aware:

// lib/logger.ts
export const logger = {
  info: (msg: string, data?: object) => {
    if (process.env.NODE_ENV !== 'production') console.log(msg, data)
    // In production: send to your logging service
  },
  error: (msg: string, error?: unknown) => console.error(msg, error)
}

Server-side route handlers should never call console.log on every request — use structured logging with sampling instead.