Debug Mode in Production Anti-Pattern

Severity: High

Summary

Debug mode in production exposes sensitive system information and creates backdoors. Occurs when development settings remain enabled in deployment. Common in AI-generated code that hardcodes debug flags or fails to differentiate environments.

The Anti-Pattern

This anti-pattern manifests in two primary ways:

1. Hardcoded Debug Flags: Global flag DEBUG = True never changes, so the application runs in debug mode in all environments.
2. Unprotected Debug Endpoints: Debug routes (/debug/env, /_debug/sql) included in production builds provide attack vectors.

BAD Code Example