Django Debug Mode in Production

Description

Detects Django applications with DEBUG = True in settings. Debug mode exposes sensitive information including settings, environment variables, SQL queries, and stack traces. This must NEVER be enabled in production.

How to fix

Load DEBUG from environment variables, defaulting to False.

```python
import os

DEBUG = os.getenv('DJANGO_DEBUG', 'False').lower() == 'true'
ALLOWED_HOSTS = ['example.com', 'www.example.com']
```

Learn more: https://shoulder.dev/learn/python/cwe-489/debug-mode

Applies to

Languages

🐍 Python

Frameworks

django

References

Documentation ↗ OWASP ↗ Learn about CWE-489

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=django-debug-mode-production .