Error rate alerting is configured

PCI-DSS Req 10.7 requires that failures of critical security controls are detected and reported promptly; OWASP A09 lists the absence of error rate alerting as a primary logging and monitoring failure. Without an error tracking service, you have no signal when your application starts throwing 500s at scale — users silently churn while a deployment bug or dependency failure goes unnoticed. CWE-778 covers this: insufficient logging of error conditions leaves the system operating in a degraded state without any operator awareness. Error rate alerting ("10 errors in 5 minutes → page on-call") is the automated trip wire that converts application errors into human-actionable incidents before they become outages.

Install and initialize an error tracking service. For Next.js, Sentry has a wizard that handles all configuration automatically.

npx @sentry/wizard@latest -i nextjs

The wizard creates sentry.client.config.ts, sentry.server.config.ts, and sentry.edge.config.ts and wires everything into next.config.js. Verify the SENTRY_DSN is added to .env.example.

Then configure a Sentry alert rule: in your project's Alerts tab, add a rule that triggers when error count exceeds 10 in a 5-minute window, routed to email or Slack. This threshold prevents alert fatigue from one-off errors while catching real degradation.