Debug Mode Enabled in Production

Why it matters

Debug mode exposes stack traces, internal file paths, database queries, and configuration details to users. Attackers use this information to map your application's internals and craft targeted exploits.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

const config = {
  debug: true,
  port: 3000
};

The smallest fix

// Use environment-based debug flag:
const debug = process.env.NODE_ENV !== 'production';
// Or remove debug: true entirely

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

How to check the fix worked

1. Set NODE_ENV=production and verify no stack traces leak
2. Trigger an error and verify the response is generic
3. Check for debug headers in responses

Further reading

• https://cwe.mitre.org/data/definitions/489.html