Development mode in production

Development servers and debug pages show more than a live site should.

What it is

A development server serves the source of the app and accepts connections meant for the developer. A framework debug page shows code, settings and sometimes keys when an error happens.

Why it matters

Hot reload endpoints and debug pages are built for a trusted machine. On the public internet they hand out source, settings and stack traces to strangers.

How Tenty checks it

Tenty looks for development server markers such as /@vite/client and webpack-dev-server in your page, and asks for a page that does not exist to see whether the answer is a framework debug page. Tenty rates the finding high.

How to fix it

Serve the production build and shut the development server down before the app goes public. Turn debug mode off in the production settings of the framework (DEBUG = False, APP_DEBUG=false, config.consider_all_requests_local = false).

How to reproduce

curl -sS 'https://YOUR-APP/this-page-does-not-exist-123'

A stack trace or a debug page in the answer is the finding.