Debug logs do not output sensitive user data to console

DevTools console output is visible to anyone with access to the browser — shared workstations, screen recordings, bug reports, and automated testing pipelines all routinely capture console output. Logging an auth token, user email, or session ID turns every debug session into a credential exposure event. CWE-200 and CWE-532 (Insertion of Sensitive Information into Log File) both apply; OWASP 2021 A09 (Security Logging and Monitoring Failures) includes logging sensitive data as a primary failure mode. Extension console output is also visible to any page script that exploits a content script bridge, making it a secondary exfiltration vector beyond direct log viewing.

Audit all console.log, console.error, and console.warn calls and redact any values that contain PII, tokens, or API keys:

// BAD — logs full user object including sensitive fields
const user = { email: 'user@example.com', token: 'Bearer sk-abc123' };
console.log('Authenticated user:', user);

// GOOD — log only non-sensitive diagnostics
console.log('User authenticated successfully');

// For development-only detail, gate behind environment check
if (process.env.NODE_ENV === 'development') {
  console.debug('Auth state:', { userId: user.id }); // userId only, no token
}

Consider using a structured logger that strips configured sensitive keys automatically rather than relying on manual review of individual log statements.