fix(web): avoid tainted PostHog log format

[kilo-code-bot]

Summary

• Replace the PostHog feature-flag payload error log template with a static format string so externally controlled flag names are passed as data instead of the console format string.
• Resolves CodeQL alert 239 (js/tainted-format-string) without changing PostHog lookup or Sentry capture behavior.

Verification

N/A - server-side logging safety change only.

Visual Changes

N/A

Reviewer Notes

CodeQL alert: https://github.com/Kilo-Org/cloud/security/code-scanning/239

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The single-line fix correctly moves flagName out of the console.error format string and into a separate argument, resolving the CodeQL js/tainted-format-string alert without altering any observable behavior.

Other Observations (not in diff)

Three similar template-literal log lines remain in the same file that could theoretically trigger the same CodeQL pattern. These are pre-existing and outside this PR's diff, but worth addressing in a follow-up for consistency:

File	Line	Issue
apps/web/src/lib/posthog-feature-flags.ts	41	console.error(\Failed to parse feature flag payload for '${flagName}':`, parseError)` — same tainted-format-string pattern
apps/web/src/lib/posthog-feature-flags.ts	68	console.error(\Error checking feature flag '${flagName}':`, error)` — same pattern
apps/web/src/lib/posthog-feature-flags.ts	106	console.error(\Error checking boolean feature flag '${flagName}':`, error)` — same pattern

Files Reviewed (1 file)

• apps/web/src/lib/posthog-feature-flags.ts

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-4.6-sonnet-20260217 · 400,794 tokens}

_{Review guidance: REVIEW.md from base branch main}