API errors are logged server-side

API routes and server actions that swallow exceptions without logging leave you with no server-side record of what failed. CWE-778 (Insufficient Logging) and CWE-391 (Unchecked Error Condition) both apply — a catch block that returns a 500 response without a log call means the failure is invisible outside of user complaints. ISO 25010 reliability.fault-tolerance requires that fault events be recorded. For Next.js server actions specifically, an unhandled throw produces an opaque digest hash in production — the error is invisible even to the framework's own logging. Without server-side logs, debugging production incidents requires guesswork from user descriptions alone.

Add a consistent logging pattern to every API route catch block, capturing the full error object (not just the message).

export async function POST(request: Request) {
  try {
    // handler logic
  } catch (error) {
    console.error('[POST /api/your-route]', {
      error,
      message: error instanceof Error ? error.message : 'Unknown error',
    })
    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
  }
}

For tRPC, configure a global error formatter in src/server/trpc.ts so all procedures log consistently. For server actions, wrap the action body in try/catch — Next.js will otherwise swallow thrown errors into opaque digest hashes in production, producing no actionable log.