Debug mode is for development. Shipped to production, it exposes internal details, full stack traces, environment values, and file paths, and in Flask it enables an interactive debugger an attacker can use to run code on your server. Read the debug setting from the environment and make sure it is off in production.
Why it's a problem
A debug error page reveals your code structure, configuration, and sometimes secrets, which is a gift to an attacker mapping your app. Flask's debugger goes further: with debug on, an unhandled error opens an interactive console that can execute Python, which is remote code execution if it is reachable. Debug on in production is both an information leak and, in some frameworks, a direct compromise.
The pattern
# Flask app.run(debug=True) # Django settings.py DEBUG = True
The fix
# Flask — off unless explicitly enabled
app.run(debug=os.environ.get("FLASK_DEBUG") == "1")
# Django — driven by the environment, default off
DEBUG = os.environ.get("DJANGO_DEBUG") == "1"Why AI tools write this
Setting debug on is the default in tutorials and quickstarts because it makes local development easier, so it is a very common completion. It runs, it helps while building, and it quietly ships to production because nothing forces it off.
The quick fix
- Drive the debug setting from an environment variable, defaulting to off.
- Confirm debug is disabled in your production configuration.
- Never expose a framework's debug error page or interactive debugger publicly.