loglint is a Go static analyzer that checks log messages for quality and safety issues. It runs as a golangci-lint plugin or as a standalone analyzer (singlechecker).

• log/slog with Info/Warn/Error/Debug, *Context, and Log
• go.uber.org/zap with SugaredLogger (Info/Infof/Infow/...) and Logger (Info/Warn/Error/...)
• log (standard library) with Print*, Fatal*, and Panic*

The analyzer also recognizes common receiver names like log, logger, l, s, sugar, and zap when deciding how to extract the message argument.

make build

make plugin

./loglint ./...

Flags:

• -config /path/to/.loglint.yml
• -fix (apply suggested fixes)

1. Build the plugin:

make plugin

2. Add it to .golangci.yml:

linters-settings:
  custom:
    loglint:
      path: ./loglint.so
      description: "Linter for checking log messages"
      original-url: github.com/alchemmist/loglint

linters:
  enable:
    - loglint

3. Run:

golangci-lint run

If your golangci-lint version supports analyzer fixes, run it with --fix to apply loglint suggestions.

Supported file names:

• .loglint.yml
• .loglint.yaml
• .loglint.json

The analyzer searches the current directory and all parent directories. You can also pass -config to point to a specific file.

rules:
  lowercase_start: true
  english_only: true
  no_special_chars: true
  no_sensitive_data: true

patterns:
  sensitive_keywords:
    - password
    - secret
    - token
    - api_key
    - private_key

{
  "rules": {
    "lowercase_start": true,
    "english_only": true,
    "no_special_chars": true,
    "no_sensitive_data": true
  },
  "patterns": {
    "sensitive_keywords": ["password", "secret", "token", "api_key", "private_key"]
  }
}

If sensitive_keywords is empty, the default keyword list is used.

Suggested fixes are provided for:

• lowercase_start: lowercases the first character
• no_special_chars: removes emojis and non-alnum characters (collapses extra spaces)

Apply fixes via -fix in the standalone CLI or via golangci-lint --fix if supported.

• Rules 1-3 only run when the log message is a string literal.
• The sensitive data rule does not scan the literal message text itself. It scans identifiers in the message expression and identifiers or string literals in arguments after the message.

# Run tests
make test

# Run tests with coverage report
make test-cover

# Run vet, formatting checks, golangci-lint, and staticcheck
make check

# Format the codebase (gofmt + gofumpt)
make fmt

# Clean build artifacts and local caches
make clean

cmd/           # Standalone CLI entrypoint
pkg/analyzer/  # Analyzer implementation, rules, and config
plugin/        # golangci-lint plugin
testdata/      # Analyzer test fixtures

MIT

• https://disaev.me/p/writing-useful-go-analysis-linter/
• https://arslan.io/2019/06/13/using-go-analysis-to-write-a-custom-linter/