react-doctor/public-debug-artifact

A browser-reachable debug, log, dump, or report file in your build output can expose source paths, internal routes, env data, or secrets.

Validation prompt

Confirm the detector match and collect the required evidence before deciding whether an edit is warranted.

Fires purely on FILE PATH and NAME, not content: a browser-reachable artifact (under public/, out/, dist/assets/, build/static/, .next/static/, .output/public/, storybook-static/, a .map, or a minified .iife/.umd/.global/.min.js bundle: server-only .next/server/.output/server excluded) whose filename is an .env file, a *.log, or a *debug|crash|trace|stack|report|dump|phpinfo*.(txt|log|json|html) dump. Locale/i18n directories (whose names echo product nouns like "trace"/"report") are exempt. The finding sits at line 1:1 and escalates from warn to ERROR when the file content also matches a hard secret value pattern (AWS/GitHub/Stripe/Slack/Discord/private-key/DB-URL).

Suppress when: a deliberately published artifact that is genuinely safe: a sanitized health/status JSON or a public report containing no source paths, internal routes, env snapshots, or tokens.

Evidence boundary

The diagnostic proves only that the detector’s modeled source pattern matched. It does not prove runtime impact, product intent, rendered failure, or that one remediation is correct.

Establish the environment, repository policy, exceptions, and required rendered or runtime evidence before deciding the occurrence.

Record one outcome:

• Confirmed failure: The required evidence establishes the violation.
• Rejected: A documented exception or false-positive predicate applies.
• Needs evidence: Named evidence can still be collected.
• Unavailable: Required evidence cannot be collected in this run.
• Waived with evidence: An authorized, scoped exception applies to an established failure.
• Observation: The review records an optional tradeoff without claiming a defect.

A waiver records its scope, authority, evidence, and review condition. It is not a pass or false positive.

Default severity is registry metadata. Use the occurrence’s JSON severity after repository configuration when ordering real findings.

Fix prompt

Apply this candidate correction only after the required evidence confirms the risk.

Delete the artifact from public build output, add its glob to .gitignore and your build tool's ignore config so it is not re-emitted, and purge it from history if it was committed. If the file contained a secret, rotate that credential now and assume it leaked. Route diagnostics through server-only logging that never reaches the browser, and strip source paths, internal routes, env data, and tokens from anything genuinely public.

Repository-wide copy prompt

Use this repository-wide prompt only after validating each occurrence. For one occurrence, use the guidance above.