diff --git a/.claude/skills/code-reviewer/SKILL.md b/.claude/skills/code-reviewer/SKILL.md index dcd41242..3a442372 100644 --- a/.claude/skills/code-reviewer/SKILL.md +++ b/.claude/skills/code-reviewer/SKILL.md @@ -84,6 +84,17 @@ Common duplication areas: - Superforms used correctly with Zod schemas? - Zod schemas defined once, not duplicated? +**Logging (server-side code only):** + +- Server-side load functions, API endpoints, and hooks should include logging at appropriate levels +- Uses `event.locals.logger` (request-scoped) in request handlers, not the root `logger` import +- Module-level singletons/services use `logger.child({ module: '...' })`, not bare `console.log` +- Context object first, message string second: `log.info({ user_id }, 'User logged in')` +- Field names use snake_case consistently (`request_id`, `user_id`, `duration_ms`, `status_code`) — not camelCase variants +- Tokens, credentials, passwords, or full request/session objects are never logged directly +- If new sensitive fields are logged, redaction paths should be added to `src/lib/server/logging/redaction.ts` +- No leftover `console.log`/`console.error` in server code (use pino logger instead) + **Accessibility (BITV 2.0 / WCAG 2.1 AA):** - Semantic HTML elements used (`