Errors that vanish in production
Security Logging and Monitoring Failures

An attacker found a BOLA bug on /api/orders/:id last Tuesday. They are patient.

1. 1
   Slow walk

   They enumerate 5,000 order IDs over six days, spaced out across different IPs so the traffic looks like normal usage.
2. 2
   Trigger errors quietly

   A handful of requests hit deleted records and return 500. The error is swallowed by a catch-all handler that returns "Server error" and logs nothing.
3. 3
   No alert fires

   There is no anomaly detection, no 500-count alarm, no per-user request counter. The infrastructure dashboard shows CPU at 4%.
4. 4
   Exfil complete

   A week later the attacker has every order. You find out when a journalist asks for comment on the dump that just appeared on BreachForums.

The breach itself was an A01 bug. The reason it ran for a week undetected is this one — nothing was watching, and nothing was writing anything down.

// app/api/orders/[id]/route.ts
export async function GET(req, { params }) {
  try {
    const order = await db.order.findUnique({ where: { id: params.id } });
    return Response.json(order);
  } catch (err) {
    // Swallowed. Gone forever.
    return Response.json({ error: 'Server error' }, { status: 500 });
  }
}

// app/api/orders/[id]/route.ts
import { logger } from '~/lib/logger';
import { reportError } from '~/lib/errors';

export async function GET(req, { params }) {
  const userId = req.headers.get('x-user-id');
  try {
    const order = await db.order.findUnique({ where: { id: params.id } });
    logger.info({ event: 'order.read', userId, orderId: params.id });
    return Response.json(order);
  } catch (err) {
    logger.error({ event: 'order.read.failed', userId, orderId: params.id, err });
    reportError(err, { userId, route: 'orders.get' });
    return Response.json({ error: 'Server error' }, { status: 500 });
  }
}

A structured log on both the happy path and the error path, and an error-reporter that forwards to something that can page a human. The response is the same to the caller — the difference is that you now know the request ever happened.