Debug prints and debugger statements left in
Debugger statements and stray debug prints in application code.
Why it matters
Agents debug the same way people do: print the value, run it again, read the output. When the bug is fixed, the prints often stay. A debugger statement added to inspect state can survive the same way.
Debug output ends up in production logs. At best it is noise you pay to store. At worst it prints request bodies, tokens or user records into logs that more people can read than the database. A debugger statement does nothing until someone opens devtools, then halts execution in a place nobody expects.
Example
export async function POST(req: Request) {
const body = await req.json();
+ console.log("checkout body", body);
const session = await createCheckoutSession(body.priceId, body.userId);
+ console.log("session", session);
+ debugger;
return Response.json({ url: session.url });
}
What it detects
- Added lines that start with console.log, console.debug, console.dir, console.trace, print(, pprint(, debugger, breakpoint(), dbg!, fmt.Print, fmt.Println, fmt.Printf, var_dump or dd(.
- Only source files are checked. Tests and anything under scripts/, bin/, cli/ or tools/ are skipped, since those print on purpose.
- At least two such lines are needed across the change; a single stray log is not reported. A debugger or breakpoint() raises the severity.
What to do when it fires
Delete the debug lines. If some of the output is worth keeping, route it through the app's logger at debug level, and check that it does not include request bodies, tokens or personal data.