Log levels are used appropriately

CWE-779 (Logging of Excessive Data) and CWE-778 (Insufficient Logging) sit at opposite ends of the same failure: logging everything at one level either floods your log store with noise or misses the signal entirely. OWASP A09 and NIST AU-2 both require that logged events carry enough severity context to support triage. When error level is used for informational messages or info is used for caught exceptions, alerting rules misfires — high-severity issues never trigger a page, and on-call engineers chase false alarms. The business impact is delayed incident response: teams lose the ability to distinguish a 500-rate spike from routine debug output.

Audit your catch blocks and log call sites and apply consistent level semantics: error for failures that require attention, warn for recoverable anomalies, info for significant business events, debug for diagnostic detail.

try {
  await processPayment(userId)
  logger.info({ userId, event: 'payment.success' }, 'Payment processed')
} catch (err) {
  logger.error({ err, userId }, 'Payment processing failed') // error — not info
}

Search for logger.info inside catch blocks across app/api/ and lib/ — those are the most common miscategorizations. Set up a Sentry alert rule on error-level log volume so you notice when the rate changes.