highConfiguration

Debug Mode Switched On

The application runs with debug mode on.

Why it matters

Debug mode is built for your laptop. Flask's debugger lets anyone who reaches an error page execute code on the server; Django's error pages list your settings, including database details. Driving it from an environment variable gives you the same convenience locally and a safe default everywhere else.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Flask app.run with debug=True
if __name__ == '__main__':
    app.run(debug=True)

The smallest fix

minimal patch
import os
DEBUG = os.getenv("DEBUG", "false").lower() == "true"
# Flask:
app.run(debug=DEBUG)

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative
# Do not call app.run() in production at all. Serve with gunicorn or
# uvicorn, keep DEBUG=false there, and set DEBUG=true only in your
# local .env. In Django, also set ALLOWED_HOSTS explicitly.

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number] debug mode is hardcoded on: [the flagged code]. Read the flag from an environment variable that defaults to false, and document DEBUG=true in .env.example for local development. Make sure the production start command (gunicorn/uvicorn) never enables the debugger.

How to check the fix worked

1. Start the app with no DEBUG variable and request a URL that raises;
   confirm you get a plain error page with no stack trace.
2. Set DEBUG=true locally and confirm the detailed page comes back.

Further reading