Debug Mode Enabled in Production

Detects debug mode enabled in production configurations, exposing stack traces, internal paths, and sensitive configuration details.

zakirkun c61edb3 2 files · 4.0 KB Updated

File contents

Debug Mode Enabled in Production

Overview

Debug mode in web frameworks exposes critical information to attackers:

  • Flask DEBUG=True: Interactive debugger in browser, allows arbitrary code execution
  • Django DEBUG=True: Full stack traces with local variable values shown to users
  • Node.js with verbose error logging: Internal file paths, stack traces
  • Spring Boot actuator: /actuator/env, /actuator/heapdump exposed

Remediation

  • Set DEBUG=False in all production configurations
  • Use environment variables to control debug settings
  • Implement a custom error handler that returns generic error messages
  • Disable development-only actuator endpoints in production

Vulnerable (Flask):

app.run(debug=True, host='0.0.0.0')  # Never in production!

zakirkun/ice-tea/tree/main/skills/infra/debug-mode commit c61edb3280

Frequently asked questions

npx skillmds@latest add zakirkun/debug-mode-enabled-in-production