fix(security): avoid tainted feature flag log format

[kilo-code-bot]

Summary

• Changed boolean feature flag error logging to use a constant format string while preserving the logged flag name and error object.
• Addresses CodeQL alert 242 (js/tainted-format-string) without changing feature flag or Sentry capture behavior.

Verification

• No manual verification; logging-only security fix with no user-visible flow.
• Targeted local test execution could not complete because the test setup requires Postgres, and Docker is unavailable in this sandbox.

Visual Changes

N/A

Reviewer Notes

• CodeQL alert: https://github.com/Kilo-Org/cloud/security/code-scanning/242

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The tainted-format-string fix is correct for isReleaseToggleEnabled, but three identical patterns remain in the same file that are not covered by this PR.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/lib/posthog-feature-flags.ts	25, 41, 68	Same js/tainted-format-string pattern remains in getFeatureFlagPayload (lines 25, 41) and isFeatureFlagEnabled (line 68) — these interpolate flagName into template literal format strings in the same way the fixed line did

Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File	Line	Issue
apps/web/src/lib/posthog-feature-flags.ts	25	console.error(\Error fetching feature flag '${flagName}':`, error)` — same tainted-format-string pattern
apps/web/src/lib/posthog-feature-flags.ts	41	console.error(\Failed to parse feature flag payload for '${flagName}':`, parseError)` — same tainted-format-string pattern
apps/web/src/lib/posthog-feature-flags.ts	68	console.error(\Error checking feature flag '${flagName}':`, error)` — same tainted-format-string pattern

All three should be changed to the same fix pattern applied here (i.e., console.error('...message...', flagName, error)) to achieve consistent treatment and likely resolve any remaining CodeQL alerts on those lines.

Files Reviewed (1 file)

• apps/web/src/lib/posthog-feature-flags.ts - 1 warning (in unchanged lines)

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-4.6-sonnet-20260217 · 358,290 tokens}

_{Review guidance: REVIEW.md from base branch main}