Flask Debug Mode in Production

Description

Detects Flask applications running with debug mode enabled. Debug mode exposes sensitive information, allows code execution through the interactive debugger, and should NEVER be enabled in production.

How to fix

Load debug mode from environment variables, defaulting to False.

```python
import os
from flask import Flask

app = Flask(__name__)

if __name__ == '__main__':
    debug = os.getenv('FLASK_DEBUG', 'False').lower() == 'true'
    app.run(debug=debug)
```

Learn more: https://shoulder.dev/learn/python/cwe-489/debug-mode

Applies to

Languages

🐍 Python

Frameworks

flask

References

Documentation ↗ OWASP ↗ Learn about CWE-489

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=flask-debug-mode-production .