Use structured logging — never console.log in production | BeforeMerge Rules | BeforeMerge

Use structured logging — never console.log in production | BeforeMerge Rules | BeforeMerge

Why This Matters

console.log in production:

Leaks secrets in error stack traces
Can't be filtered by log level
No timestamps for debugging timing issues
No structured data for log aggregation

Good

import { log } from "./logger"
 
log.info({ scanId, tool: "semgrep" }, "tool_start")
log.error({ scanId, error: msg }, "scan_failed")

Bad

console.log("starting scan...")
console.error(JSON.stringify({ event: "error", details: err }))