Debug Mode Enabled in Production

What Is This Vulnerability?

Running a production application with debug mode enabled exposes detailed error messages, stack traces, environment variables, database queries, and internal application state to anyone who encounters an error. Frameworks like Django, Laravel, Flask, and Express all have debug modes that reveal sensitive internals when triggered.

Why It Happens

Debug mode is essential during development for troubleshooting. Developers enable it locally and the setting gets committed to configuration files or environment templates. Some deployment scripts fail to override the debug flag for production. Environment variable defaults may be set to 'true' in code, and the production environment never explicitly sets them to 'false'.

Example Code

# settings.py
DEBUG = True
SECRET_KEY = "django-insecure-dev-key-12345"
ALLOWED_HOSTS = ["*"]

DATABASES = {
    "default": {
        "ENGINE": "django.db.backends.postgresql",
        "NAME": "myapp_db",
        "USER": "admin",
        "PASSWORD": "admin123",
    }
}

import os

DEBUG = os.environ.get("DJANGO_DEBUG", "False").lower() == "true"
SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]
ALLOWED_HOSTS = os.environ.get("ALLOWED_HOSTS", "").split(",")

DATABASES = {
    "default": {
        "ENGINE": "django.db.backends.postgresql",
        "NAME": os.environ["DB_NAME"],
        "USER": os.environ["DB_USER"],
        "PASSWORD": os.environ["DB_PASSWORD"],
    }
}

How Hackers Exploit It

Attackers deliberately trigger errors (404 pages, malformed requests, SQL injection attempts) to view debug output. The information disclosed often includes source code paths, database connection strings, API keys, session secrets, and installed package versions. This reconnaissance data dramatically simplifies further attacks against the application.

How to Fix It

Always set debug mode to false in production environments. Use environment variables for all configuration with safe defaults (debug off). Implement custom error pages that hide internal details. Set up structured logging that captures debug information server-side without exposing it to users. Add deployment checks that verify debug mode is disabled.

Frequently Asked Questions