Logging and monitoring in production: see failures before the client does
console.log is not observability. Minimum stack for Next.js apps and APIs serving paying clients in PR and LatAm.
Apps without structured logging discover breaches when the angry client calls — or worse, when they already appear on The Hacker News. For SMBs selling SaaS or portals from Puerto Rico, minimum observability is a trust feature, not DevOps luxury.
Baseline: JSON logs with correlated requestId, correct level
Baseline: JSON logs with correlated requestId, correct levels (error/warn/info), redacted PII, 30–90 day retention per compliance. Application errors to Sentry or similar with Slack/email alerts; latency and 5xx metrics in CloudWatch, Datadog, or Vercel Analytics per hosting.
Log security events separately: auth failure spikes, permiss
Log security events separately: auth failure spikes, permission denied, mass input validation failures (possible scan). Threshold alerts — do not page on every 404.
Next.js: middleware logging on sensitive routes, server actions with try/catch reporting without leaking secrets, edge vs node runtimes understood to avoid losing context. Correlating frontend error boundary with backend traceId dramatically improves MTTR.
Controlled cost: sample debug logs in prod, full in staging. Monthly review of noisy alerts — pager fatigue kills real response. Google Security Blog emphasizes detection; without logs you only have post-incident guesses.
Writes about practical cybersecurity for SMBs in Puerto Rico and the Caribbean — no fluff, just what actually needs to get done.
