Client code contains a supported sensitive console-log signal
ShipReady found a console logging call in shipped client content that references a supported credential-like field name.
Why it matters
Production diagnostic output should be reviewed when it appears to reference security-sensitive values.
How ShipReady detects it
What it inspects
ShipReady inspects fetched executable client content and supported inline regions for console logging patterns, while excluding supported line-comment cases.
What triggers a finding
The rule triggers when a supported console call includes a field name matched by ShipReady's credential-like naming heuristic.
What the evidence shows
The inspected client content contains a supported console-log pattern with a credential-like field name.
Limits of this check
ShipReady does not execute the call, retain the logged value, prove a real secret was logged, inspect browser consoles, or determine whether third-party monitoring received data.
How to fix it
Review the logging call
Remove or redact unnecessary production diagnostics and verify that sensitive values are not passed to client-side logging.
How to verify the change
Inspect the deployed client build
Check the affected source and shipped output after deployment.
Expected: No unintended supported sensitive console-log pattern remains.