diff --git a/cmd/vulncheck_sandbox/vulncheck_sandbox_test.go b/cmd/vulncheck_sandbox/vulncheck_sandbox_test.go
index 87a178d..7dbe9bc 100644
--- a/cmd/vulncheck_sandbox/vulncheck_sandbox_test.go
+++ b/cmd/vulncheck_sandbox/vulncheck_sandbox_test.go
@@ -15,7 +15,7 @@
 	"testing"
 
 	"golang.org/x/exp/slices"
-	"golang.org/x/pkgsite-metrics/internal/log"
+	"golang.org/x/pkgsite-metrics/internal/derrors"
 	"golang.org/x/pkgsite-metrics/internal/worker"
 	"golang.org/x/vuln/vulncheck"
 )
@@ -49,7 +49,7 @@
 		cmd := exec.Command("go build")
 		cmd.Dir = "testdata/module"
 		if _, err := cmd.Output(); err != nil {
-			t.Fatal(log.IncludeStderr(err))
+			t.Fatal(derrors.IncludeStderr(err))
 		}
 		defer os.Remove(binary)
 		res, err := runTest([]string{worker.ModeBinary, binary}, "testdata/vulndb")
diff --git a/internal/derrors/derrors.go b/internal/derrors/derrors.go
index 2e00c86..0a89df7 100644
--- a/internal/derrors/derrors.go
+++ b/internal/derrors/derrors.go
@@ -7,8 +7,10 @@
 package derrors
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
+	"os/exec"
 	"runtime"
 	"strings"
 
@@ -204,3 +206,13 @@
 func IsGoVersionMismatchError(msg string) bool {
 	return strings.Contains(msg, "can't be built on Go")
 }
+
+// IncludeStderr includes the stderr with an *exec.ExitError.
+// If err is not an *exec.ExitError, it returns err.Error().
+func IncludeStderr(err error) string {
+	var eerr *exec.ExitError
+	if errors.As(err, &eerr) {
+		return fmt.Sprintf("%v: %s", eerr, bytes.TrimSpace(eerr.Stderr))
+	}
+	return err.Error()
+}
diff --git a/internal/log/log.go b/internal/log/log.go
index 778fdab..7976bcf 100644
--- a/internal/log/log.go
+++ b/internal/log/log.go
@@ -6,14 +6,11 @@
 package log
 
 import (
-	"bytes"
 	"context"
-	"errors"
 	"fmt"
 	"io"
 	"log"
 	"os"
-	"os/exec"
 	"reflect"
 	"strings"
 	"sync"
@@ -283,13 +280,3 @@
 	log.Printf("Error: %s is invalid LogLevel. Possible values are [debug, info, warning, error, fatal]", v)
 	return logging.Default
 }
-
-// IncludeStderr includes the stderr with an *exec.ExitError.
-// If err is not an *exec.ExitError, it returns err.Error().
-func IncludeStderr(err error) string {
-	var eerr *exec.ExitError
-	if errors.As(err, &eerr) {
-		return fmt.Sprintf("%v: %s", eerr, bytes.TrimSpace(eerr.Stderr))
-	}
-	return err.Error()
-}
diff --git a/internal/sandbox/sandbox_test.go b/internal/sandbox/sandbox_test.go
index b396652..af240fa 100644
--- a/internal/sandbox/sandbox_test.go
+++ b/internal/sandbox/sandbox_test.go
@@ -12,7 +12,7 @@
 	"strings"
 	"testing"
 
-	"golang.org/x/pkgsite-metrics/internal/log"
+	"golang.org/x/pkgsite-metrics/internal/derrors"
 )
 
 // These tests require a minimal bundle, in testdata/bundle.
@@ -32,7 +32,7 @@
 	t.Run("printargs", func(t *testing.T) {
 		out, err := sb.Run(ctx, "/printargs", "a", "b")
 		if err != nil {
-			t.Fatal(log.IncludeStderr(err))
+			t.Fatal(derrors.IncludeStderr(err))
 		}
 
 		want := `args:
diff --git a/internal/worker/analysis.go b/internal/worker/analysis.go
index 1cc42d1..e9fa08e 100644
--- a/internal/worker/analysis.go
+++ b/internal/worker/analysis.go
@@ -150,7 +150,7 @@
 	cmd.Dir = moduleDir
 	out, err := cmd.Output()
 	if err != nil {
-		return nil, fmt.Errorf("running analysis binary %s: %s", binaryPath, log.IncludeStderr(err))
+		return nil, fmt.Errorf("running analysis binary %s: %s", binaryPath, derrors.IncludeStderr(err))
 	}
 	var tree JSONTree
 	if err := json.Unmarshal(out, &tree); err != nil {
diff --git a/internal/worker/vulncheck_scan.go b/internal/worker/vulncheck_scan.go
index 4d288e6..5068d2b 100644
--- a/internal/worker/vulncheck_scan.go
+++ b/internal/worker/vulncheck_scan.go
@@ -334,13 +334,13 @@
 	_, err := cmd.Output()
 	if err != nil {
 		return nil, fmt.Errorf("%w: 'go mod download' for %s@%s returned %s",
-			derrors.BadModule, modulePath, version, log.IncludeStderr(err))
+			derrors.BadModule, modulePath, version, derrors.IncludeStderr(err))
 	}
 	log.Infof(ctx, "go mod download succeeded")
 	log.Infof(ctx, "%s@%s: running vulncheck in sandbox", modulePath, version)
 	stdout, err := sbox.Run(ctx, "/binaries/vulncheck_sandbox", "-gomodcache", "/"+sandboxGoModCache, mode, sandboxDir)
 	if err != nil {
-		return nil, errors.New(log.IncludeStderr(err))
+		return nil, errors.New(derrors.IncludeStderr(err))
 	}
 	return stdout, nil
 }
@@ -366,7 +366,7 @@
 	log.Infof(ctx, "%s@%s/%s: running vulncheck in sandbox on %s", modulePath, version, binDir, destf.Name())
 	stdout, err := s.sbox.Run(ctx, "/binaries/vulncheck_sandbox", ModeBinary, destf.Name())
 	if err != nil {
-		return nil, errors.New(log.IncludeStderr(err))
+		return nil, errors.New(derrors.IncludeStderr(err))
 	}
 	return unmarshalVulncheckOutput(stdout)
 }
@@ -747,7 +747,7 @@
 		out, err = s.sbox.Run(ctx, "/binaries/vulncheck_sandbox", "-gomodcache", "/"+sandboxGoModCache, "-clean")
 	}
 	if err != nil {
-		return fmt.Errorf("cleaning Go caches: %s", log.IncludeStderr(err))
+		return fmt.Errorf("cleaning Go caches: %s", derrors.IncludeStderr(err))
 	}
 	output := ""
 	if len(out) > 0 {