SH001: Debug mode enabled

Severity: high · Category: security · Applies to: all projects

Why it matters

Debug mode prints stack traces, configuration and environment values to visitors, which hands attackers a map of the application and sometimes its secrets.

How to fix

Set APP_DEBUG=false (and NODE_ENV=production) for every deployed environment.

Auto-fix

devshield fix can resolve this rule for the cases it can change safely. Preview it with devshield fix --dry-run --only SH001.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH001

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH001