Group
  • Security

    Turn off debug mode and dev tools in production

    Finds debug flags, verbose error pages, and development-only routes that are still on in the production build and disables them.

    • Improve quality
    • Plan & validate
    • Beginner
    • Replit
    • Cursor
    • Bolt
    • Lovable
    • General

Free Prompt

Find every debug and development-only feature in my app that could still be active in production, and wire each one to the environment so it is off in production. Look for: framework debug flags (DEBUG=true, Flask/Rails/Django debug mode, Next.js or Express verbose error settings), detailed error pages that show stack traces, file paths, or environment values to visitors, development-only routes like /debug, /__dev, /test, seed endpoints, or mock-login routes, GraphQL playgrounds and introspection, source maps served publicly, and console logging of sensitive values like tokens, passwords, or full request bodies. For each one, gate it on the environment: debug features active only when NODE_ENV (or my framework's equivalent) is not production, never on a hardcoded true. Production errors should show a generic message to the user and log the details server-side. Dev routes should either be removed from the production build or return 404 outside development. Do not delete logging I need for debugging real production issues; move it behind proper server-side logging instead. Do not change local development behavior. Give me a list of everything you found, what environment check now guards it, and how to verify each item is off in the production deployment.

What This Does / How This Helps

Sweeps your app for every debug switch, dev route, and verbose error page, and ties each one to the environment so production never exposes them. Debug mode is a gift to attackers. Stack traces leak file paths, framework versions, and sometimes environment variables. Seed and mock-login routes that were convenient during development become free admin accounts in production. This is one of the most common findings in vibe-coded apps because AI scaffolds turn debug features on and nobody turns them off. The prompt does not just flip flags. It routes real error detail to server-side logs where you can still use it, and gives you a verification step per item so you can confirm each one is actually off after deploy.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts