debug-mode-production-anti-pattern

name	debug-mode-production-anti-pattern
description	Security anti-pattern for debug mode in production (CWE-215). Use when generating or reviewing code that configures application settings, deployment configurations, or error handling. Detects hardcoded debug flags and development-only features in production.

Debug Mode in Production Anti-Pattern

Severity: High

Summary

Debug mode in production exposes sensitive system information and creates backdoors. Occurs when development settings remain enabled in deployment. Common in AI-generated code that hardcodes debug flags or fails to differentiate environments.

The Anti-Pattern

This anti-pattern manifests in two primary ways:

1. Hardcoded Debug Flags: Global flag DEBUG = True never changes, so the application runs in debug mode in all environments.
2. Unprotected Debug Endpoints: Debug routes (/debug/env, /_debug/sql) included in production builds provide attack vectors.

BAD Code Example

# VULNERABLE: Hardcoded debug flag and unprotected debug routes
import os
from flask import Flask, jsonify

app = Flask(__name__)
app.config['DEBUG'] = True # Hardcoded debug mode

@app.route("/")
def index():
    return "Welcome!"

# This debug route exposes all environment variables, including potential secrets.


 ():
     app.config[]:
         jsonify(os.environ.copy())
     

 __name__ == :
    app.run()