lowConfiguration

Debug or Development Mode Forced On

Debug or development mode is switched on in code, so it stays on in production.

Why it matters

Debug mode makes the app explain itself: full error messages, stack traces with file paths, query logs. That is useful on your laptop and a gift to anyone probing the live site. Because it is hardcoded, deploying does not turn it off.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

NODE_ENV assigned in server code

import express from 'express';
process.env.NODE_ENV = 'development';
const app = express();

The smallest fix

minimal patch

// Decide from the environment, never from a literal:
const isDev = process.env.NODE_ENV !== 'production';
app.use(errorHandler({ debug: isDev }));

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number], debug or development mode is hardcoded: [the flagged code]. Make it depend on process.env.NODE_ENV so it is off in production, and never assign NODE_ENV in code.

How to check the fix worked

1. Run with NODE_ENV=production and trigger an error; the response must
   not include a stack trace or file paths.
2. Run without NODE_ENV and confirm the app still starts.