Shipped JavaScript logs sensitive data to the browser console

Why it matters

Your production JavaScript contains console logging that prints values named as credentials (the value). Anything written to the console is visible in devtools to anyone using the browser, it is captured in screen recordings and support screenshares, and error monitors such as Sentry record console output as breadcrumbs — which copies the value into a third-party service you may not have meant to send it to. This is almost always debug logging that was never removed before launch: it costs nothing to strip, and most bundlers can drop console calls in production builds automatically.

How ShipReady detects it

Launch signals carried by a PAGE's own markup: basic metadata, and a default framework title left in place. Genuinely per-page - a polished homepage routinely hides a /pricing that still says "Create Next App", which is exactly the defect this catches. Reads only the already-fetched HTML and issues no requests of its own.

Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.10.0.

How to fix it

This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.

Your shipped JavaScript logs credential-named values to the browser console (such as a token or password). Search your frontend for console.log/warn/info/debug calls that print these fields and delete them — start with authentication, checkout and API-client code, where debug logging is usually added while wiring things up and then forgotten. Then stop it recurring: strip console calls from production builds automatically (Next.js: `compiler: {{ removeConsole: {{ exclude: ['error'] }} }}` in next.config; Vite/Terser: `terserOptions.compress.drop_console`; or the no-console ESLint rule to catch them in review). If any of these values reached an error monitor such as Sentry via console breadcrumbs, treat them as disclosed and rotate them.

Frequently asked questions

What does "Shipped JavaScript logs sensitive data to the browser console" mean?

Your production JavaScript contains console logging that prints values named as credentials (the value).

How serious is it?

ShipReady rates this medium. Fix soon. Meaningfully weakens a defence or degrades how the site works.

How do I fix it?

Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.

Can I check my own site?

Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.

Related checks

• A development build is being served to real visitorsmedium
• Missing Basic HTML Metadatamedium
• Page says it does not exist but returns a success statusmedium
• Placeholder template content is still live on the sitemedium
• Production build points at localhostmedium
• Production build references a staging or preview environmentmedium