Source code Stability Releases Code quality Security & compliance

Observability gaps

Whether you could debug an incident from what you log today.

Overview

This check reads your logging, error reporting, and health endpoints, and reports what an on-call engineer would be missing at 3am. It also flags the opposite problem: logs carrying data they should never hold.

What it looks for

  • console.log in place of a structured logger
  • No request or correlation IDs across service boundaries
  • No error-reporting integration wired up
  • Missing health and readiness endpoints, or a health check that never touches the database
  • Authorization headers and other secrets written to logs in plaintext
  • Fire-and-forget calls that swallow their own failures

Why it matters

console.log with no request ID cannot reconstruct a failed user journey. A health endpoint that returns 200 without touching the database keeps a broken instance in the load balancer rotation for as long as it takes someone to notice.

Rules in this check

How the fixes arrive

Pull requestLow-risk changes arrive as a pull request on a lumioguard branch, with a breakage analysis attached. You review and merge it.
DraftChanges that need confirming against your live schema or config arrive as a draft — a prepared patch or a ready-to-run script — that you approve before it is applied.
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.