Error logging includes stack trace and context

NIST AU-3 requires that logged records contain sufficient information to establish what happened, when, who was involved, and what was affected. CWE-778 covers the failure mode directly: when errors are caught and logged with only err.message, the stack trace is discarded and the context of what triggered the error is lost. In practice this means that when a payment failure or auth error occurs at 3 AM, the engineer on call has a string like 'Unexpected token in JSON' and nothing else to work from — no file, no line, no user ID, no operation. The missing stack trace typically adds 20–60 minutes to incident resolution. OWASP A09 calls out insufficient error context as a core logging failure.

Pass the full error object as a property — not err.message as a string — so your logging library serializes the stack trace automatically.

// WRONG — stack trace is discarded
logger.error(err.message)
logger.error('Payment failed: ' + err.message)

// RIGHT — stack trace preserved, context included
logger.error({ err, userId, operationId: 'create-subscription' }, 'Subscription creation failed')

Pino, Winston, and Bunyan all serialize Error objects (including .stack) when they appear as a property of the first argument. Search for catch (err) blocks across lib/ and app/api/ and verify each one passes { err, ...context }, not just err.message.