console.log left in source
Part of Code Quality & Syntax, which counts for 20% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
Leftover console.log/console.debug statements in shipped source are a common vibe-coding leftover and can leak data.
Why it matters
Stray console.log calls ship to every visitor, and anything they print (user data, tokens, internal state) is visible to anyone who opens devtools. They also bury real errors in noise exactly when you are trying to debug a production issue.
How to fix it
Delete the statements, or replace the ones that carry real diagnostic value with a proper logger (pino or winston on the server, a small debug-flag wrapper in the browser). Then add the ESLint no-console rule with warn and error allowed so new ones fail CI, and run the linter with --fix before committing.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo