@noctcore/eslint-plugin-observability 0.2.0 → 0.3.0

package/README.md

@@ -40,6 +40,6 @@ export default [
 | Rule | Description | Recommended |
 | --- | --- | --- |
 | [`structured-log-arguments`](./docs/rules/structured-log-arguments.md) | Pass dynamic values in a structured context object, not interpolated into the message string. | `error` |
-| [`no-sensitive-fields-in-logs`](./docs/rules/no-sensitive-fields-in-logs.md) | Name-heuristic guard against writing credentials/secrets into log sinks. | `warn` |
+| [`no-sensitive-fields-in-logs`](./docs/rules/no-sensitive-fields-in-logs.md) | Name-heuristic guard against writing credentials/secrets into log sinks. | `error` |
 | [`no-error-detail-loss`](./docs/rules/no-error-detail-loss.md) | A catch block that reports failure must log the error itself, not only `e.message`. | `error` |
 | [`audit-pii-declared`](./docs/rules/audit-pii-declared.md) | A PII-shaped key written into an audit payload must be declared: registered for scrubbing on purge, or declared non-PII. Enforces declaration, not deletion. Inert until `auditCallees` is set. | `error` |

package/dist/index.cjs

@@ -29,7 +29,7 @@ module.exports = __toCommonJS(index_exports);
 // src/configs/recommended.ts
 var recommended = {
   "noctcore-observability/structured-log-arguments": "error",
-  "noctcore-observability/no-sensitive-fields-in-logs": "warn",
+  "noctcore-observability/no-sensitive-fields-in-logs": "error",
   "noctcore-observability/no-error-detail-loss": "error",
   // Inert until you set `auditCallees`, so it ships enabled but checks nothing by default.
   "noctcore-observability/audit-pii-declared": "error"

package/dist/index.js

@@ -1,7 +1,7 @@
 // src/configs/recommended.ts
 var recommended = {
   "noctcore-observability/structured-log-arguments": "error",
-  "noctcore-observability/no-sensitive-fields-in-logs": "warn",
+  "noctcore-observability/no-sensitive-fields-in-logs": "error",
   "noctcore-observability/no-error-detail-loss": "error",
   // Inert until you set `auditCallees`, so it ships enabled but checks nothing by default.
   "noctcore-observability/audit-pii-declared": "error"

package/docs/rules/no-sensitive-fields-in-logs.md

@@ -1,6 +1,6 @@
 # `noctcore-observability/no-sensitive-fields-in-logs`
 
-> A name-heuristic guard against writing credentials and secrets into log sinks. Ships at `warn`.
+> A name-heuristic guard against writing credentials and secrets into log sinks. Ships at `error`.
 
 ## Why
 
@@ -9,8 +9,10 @@ Logs are long-lived, widely readable, and shipped to third-party aggregators. A
 request by months. This rule catches the most common shape — a variable, property, or object key
 whose **name** matches a sensitive-field denylist appearing inside a logger call.
 
-It reads **names, never values**, so it is a heuristic and ships at `warn`, not `error` — treat a hit
-as "look here", not "definitely a bug".
+It reads **names, never values**, so it is a heuristic. It still ships at `error`: a miss puts a
+credential in a long-lived log sink, while a false positive costs a rename or an explicit `redact()`.
+Tests that log a secret on purpose (to prove a redaction boundary works) should turn the rule off for
+those files in config.
 
 ## What it flags
 
@@ -55,4 +57,4 @@ type Options = {
 ## When not to use it
 
 If your logging pipeline already redacts sensitive fields centrally (a serializer denylist), this
-rule is redundant. Otherwise keep it on at `warn` as a second line of defence.
+rule is redundant. Otherwise keep it on at `error` as a second line of defence.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noctcore/eslint-plugin-observability",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Structured-logging discipline ESLint rules — context objects over interpolated messages, no sensitive fields in logs, no error-detail loss.",
   "license": "MIT",
   "type": "module",