companion: set debug based on NODE_ENV only if the env var is available

[ifedapoolarewaju]

in a system where the NODE_ENV variable is never used as part of their config variables to begin with, it'll be unsafe to assume the system is in debug mode by merely checking NODE_ENV !== 'production'

[goto-bus-stop]

Hm, should we use === 'development' then?

[ifedapoolarewaju]

didn't want to go with that because of === 'test', and the likes

[goto-bus-stop]

fair enough :) happy with this then!

[arturi]

I also wonder if we need to be explicit that we want to expose debug information, otherwise something like staging (relatively publicly available) could also leak something?

[kvz]

In addition we should replace actual credentials with:

• ********, or:
• ${CREDENTIAL_FOO} (obfuscated for security)

in our lowest level logging function (so right before it hits stdout/stderr)

[ifedapoolarewaju]

In addition we should replace actual credentials with:

• ********, or:
• ${CREDENTIAL_FOO} (obfuscated for security)

in our lowest level logging function (so right before it hits stdout/stderr)

@kvz do you think it's fine if I make this change in a separate PR? I'm suggesting this because I think it my be subject to a longer review process.

[kvz]

Yes 👌

[ifedapoolarewaju]

I also wonder if we need to be explicit that we want to expose debug information, otherwise something like staging (relatively publicly available) could also leak something?

@arturi so you mean to explicitly mention this in the docs?