Source code
Stability
Releases
Code quality
Security & compliance
Observability gaps
Whether you could debug an incident from what you log today.
Overview
This check reads your logging, error reporting, and health endpoints, and reports what an on-call engineer would be missing at 3am. It also flags the opposite problem: logs carrying data they should never hold.
What it looks for
- console.log in place of a structured logger
- No request or correlation IDs across service boundaries
- No error-reporting integration wired up
- Missing health and readiness endpoints, or a health check that never touches the database
- Authorization headers and other secrets written to logs in plaintext
- Fire-and-forget calls that swallow their own failures
Why it matters
console.log with no request ID cannot reconstruct a failed user journey. A health endpoint that returns 200 without touching the database keeps a broken instance in the load balancer rotation for as long as it takes someone to notice.
Rules in this check
| What it reports | Fix path |
|---|---|
| Console.log-only / no structured logger | Guide |
| No request / correlation IDs | Guide |
| No error-reporting integration | Guide |
| No health / readiness endpoint | Draft |
| Health endpoint doesn't check DB | Draft |
| No distributed tracing (multi-service) | Guide |
| Authorization header logged in plaintext | Pull request |
| Silent failure / fire-and-forget | Pull request |
How the fixes arrive
Pull requestLow-risk changes arrive as a pull request on a lumioguard branch, with a breakage analysis attached. You review and merge it.
DraftChanges that need confirming against your live schema or config arrive as a draft — a prepared patch or a ready-to-run script — that you approve before it is applied.
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.