No print()

ID

python.no_print

Severity

info

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

Resource

Code Smell

Language

Python

Tags

best-practice, leftover-debug

Description

Reports calls to the builtin print(…​). A leftover print in production code leaks internal state to stdout (sometimes including PII captured during local debugging), pollutes operator output, and bypasses the structured logger that the application configures.

print("hello")                 # FLAW
print(state, file=sys.stderr)  # FLAW

logger.info("hello")           # OK
obj.print()                    # OK — method, not the builtin

Rationale

print is the universal debug habit — easy to add, easy to forget. In a deployed service, every print writes to whatever the process’s stdout is wired to (often a journal log that the team does not actually read), and double-logs whatever the proper logger would have emitted. In CLI tools the line is blurrier; for those, this rule should be disabled in the scan profile rather than worked around.

Remediation

Use a real logger:

import logging
logger = logging.getLogger(__name__)

logger.debug("state: %s", state)
logger.info("started")

For genuine CLI output, route through click.echo, rich.print, or the framework’s standard output helper rather than the builtin. For one-off debugging, delete the line before merging.

Notes

The rule fires only on bare print(…​) where the receiver is the unqualified identifier print. Method calls of the form obj.print(…​) are out of scope.

References