fix(web): avoid tainted feature flag log format

[kilo-code-bot]

Summary

• Resolve CodeQL alert 241 by changing the feature flag error log to use a static format string with flagName passed as data.
• Preserve existing logging and Sentry capture behavior while avoiding an externally controlled format string sink.

Verification

• Manual testing not run; this is a server-side logging-only CodeQL remediation with no user-facing flow.

Visual Changes

N/A

Reviewer Notes

• CodeQL alert: https://github.com/Kilo-Org/cloud/security/code-scanning/241

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The targeted fix correctly resolves CodeQL alert 241, but three sibling console.error calls in the same file still use template-literal interpolation of flagName and may trigger the same alert class.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Other Observations (not in diff)

These issues exist in unchanged lines and cannot receive inline comments:

File	Line	Issue
apps/web/src/lib/posthog-feature-flags.ts	25	console.error(\Error fetching feature flag '${flagName}':, error) — same tainted format string pattern as the fixed line; flagName is interpolated directly into the first argument
apps/web/src/lib/posthog-feature-flags.ts	41	console.error(\Failed to parse feature flag payload for '${flagName}':, parseError) — same issue
apps/web/src/lib/posthog-feature-flags.ts	106	console.error(\Error checking boolean feature flag '${flagName}':, error) in isReleaseToggleEnabled — same issue

WARNING: If CodeQL is scanning all three of these call sites, the remaining three will still surface alerts. To be consistent and fully remediate, update them to the same pattern used in this fix:

console.error("Error fetching feature flag '%s':", flagName, error);
console.error("Failed to parse feature flag payload for '%s':", flagName, parseError);
console.error("Error checking boolean feature flag '%s':", flagName, error);

Files Reviewed (1 file)

• apps/web/src/lib/posthog-feature-flags.ts — 1 warning (in unchanged lines)

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-4.6-sonnet-20260217 · 250,366 tokens}

_{Review guidance: REVIEW.md from base branch main}