No console.log in production code

Debug console.log statements left in production code expose internal data structures, user data, and system internals in the browser console and server logs — visible to anyone who opens DevTools or has log access. ISO 25010:2011 §6.5.2 classifies this as a maintainability defect. Beyond the information exposure risk, uncontrolled log output fills log aggregators with noise, makes filtering for real errors harder, and signals to engineers that the codebase lacks basic hygiene standards.

Remove debug console.log statements from production source files. For intentional production logging, use a level-aware logger so output can be controlled by environment:

// src/lib/logger.ts
const isDev = process.env.NODE_ENV === 'development'

export const logger = {
  info: (msg: string, data?: unknown) => {
    if (isDev) console.info('[info]', msg, data)
  },
  error: (msg: string, error?: unknown) => {
    console.error('[error]', msg, error) // always log errors
  },
}

Enforce via ESLint so it is caught in CI:

{ "rules": { "no-console": ["error", { "allow": ["error", "warn"] }] } }