No `console.*` (Outside the Allow List)

javascript.no_console

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Best Practice

Language

JavaScript

Description

Reports calls to console.* whose method is not on the rule’s allow list. The default list keeps console.error and console.warn and rejects everything else:

console.log("debug stuff");        // FLAW
console.debug(state);              // FLAW
console.info("started");           // FLAW
console.error("oh no", err);       // OK
console.warn("deprecated");        // OK

Rationale

Leftover console.log / console.debug / console.info calls in production code are real costs:

they leak internal state to the end user’s DevTools — sometimes including PII, request headers, or auth tokens captured during local debugging,
they pollute the browser console for legitimate users investigating their own issues,
they keep hold of references that would otherwise be garbage-collected, especially in hot paths,
server-side, they double up with proper logging frameworks and obscure the structured logs.

console.error and console.warn are the production-acceptable subset: real errors and deprecations belong in the user’s console, and they typically go through structured-log adapters in the browser.

Remediation

Use a real logger:

import { logger } from "./logging";

logger.debug("state", state);
logger.info("started", { user });

Or remove the leftover entirely.

For CLI tools and scripts where console.log is the user interface, extend the allow list in the scan profile:

javascript.no_console:
  allowedMethods: [error, warn, log]

Notes

The rule fires on console.<method>(…) only when the receiver is the literal identifier console. Aliased calls (const c = console; c.log(…)) are not detected — that pattern is rare enough that we accept the false negative for the precision win.

References

MDN — console