# Active Debug Code (CWE-489)

The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or information leaks.

**Stack:** JavaScript

- Prevalence: Élevée Fréquemment exploitée
- Impact: Critique 1 règles de sévérité critique
- Prevention: Documentée 6 exemples de correctifs

**OWASP:** Security Misconfiguration (A05:2021-Security Misconfiguration) - #5

## Description

Debug code is often written to allow easier testing and debugging. This code is not intended to be shipped to production but is sometimes inadvertently left in the product. Debug code often exposes information about the product's internal structure or creates additional attack surface.

## Prevention

Stratégies de prévention pour Active Debug Code basées sur 1 règles de détection Shoulder.

### JavaScript

Use environment variables for debug configuration instead of hardcoded flags

## Warning Signs

- [MEDIUM] Debug flag at line ... is hardcoded to true
- [MEDIUM] hardcoded debug flags that expose sensitive information or enable debugging features in production

## Consequences

- Lecture des données de l'application
- Contourner le mécanisme de protection
- Exécuter du code non autorisé

## Mitigations

- Supprimez le code de débogage avant de déployer le produit en production
- Utilisez des configurations de build qui excluent automatiquement le code de débogage des builds de production
- Auditez le code à la recherche de points de terminaison de débogage et de portes dérobées avant la mise en production

## Detection

- Total rules: 6
- Critical: 1
- Languages: python, go, javascript, typescript

## Rules by Language

### Javascript (1 rules)

- **Debug Mode Enabled in Production** [MEDIUM]: Detects hardcoded debug flags that expose sensitive information or enable debugging features in production.
  - Remediation: Use environment variables for debug/development mode configuration.

### Typescript (1 rules)

- **Debug Mode Enabled in Production** [MEDIUM]: Detects hardcoded debug flags that expose sensitive information or enable debugging features in production.
  - Remediation: Use environment variables for debug/development mode configuration.