Deploy

Log errors without logging secrets

Add Sentry or similar, read Vercel runtime logs, and keep tokens, passwords and personal data out of your logs.

Why it matters

Most users leave rather than report a bug, so without logging you won't know production is broken. Careless logging creates a second leak: tokens and personal data sitting in a log tool.

How to fix it

1. Add an error tracker such as Sentry and confirm a test error appears.
2. Check Vercel runtime logs after deploys.
3. Don't log whole request bodies, headers or user objects. Remove tokens, passwords and personal data like emails and addresses.
4. Return generic error messages to users; keep details in the logs.

How to verify

• Trigger a test error and find it in the tracker.
• Search your logs for Bearer, password and @.

Related checks

• Don't leave debug, admin or test routes public
• Set billing alerts on every paid service
• Have backups and test a restore

Tick it off in the full checklist