zakirkun Debug Mode Enabled in Production
Overview
Debug mode in web frameworks exposes critical information to attackers:
- Flask DEBUG=True: Interactive debugger in browser, allows arbitrary code execution
- Django DEBUG=True: Full stack traces with local variable values shown to users
- Node.js with verbose error logging: Internal file paths, stack traces
- Spring Boot actuator:
/actuator/env,/actuator/heapdumpexposed
Remediation
- Set
DEBUG=Falsein all production configurations - Use environment variables to control debug settings
- Implement a custom error handler that returns generic error messages
- Disable development-only actuator endpoints in production
Vulnerable (Flask):
app.run(debug=True, host='0.0.0.0') # Never in production!