Debug/dev mode in prod config
Part of the Production readiness check · fix arrives as a pull request
What it is
A debug or development setting is enabled in production configuration — verbose error pages, a debug flag, source maps served publicly, or a development-mode framework build.
Why it matters
Debug output tells an attacker about your stack, file paths, and sometimes environment values, and development builds are substantially slower. Framework debug pages have historically exposed configuration outright.
How to fix it
Drive the setting from the environment and assert at startup that debug is off in production. Check the built artifact rather than the config file — the value that matters is the one baked into the deployed bundle.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.