v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.nextauth.debug-enabled

The NextAuth/Auth.js config hard-codes debug: true.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Debug mode writes verbose diagnostics, including provider responses and token material, to the server logs, and leaving it on in production leaks that data to anyone who can read the logs. Gate it on the environment instead, for example debug: process.env.NODE_ENV !== 'production', or remove the flag so it defaults to off.

VULNERABLE
vulnerable.ts
import NextAuth from 'next-auth';
import type { NextAuthConfig } from 'next-auth';

export const authConfig: NextAuthConfig = {
  providers: [],
  // ruleid: auth.nextauth.debug-enabled
  debug: true,
};

export const { handlers } = NextAuth({
  providers: [],
  // ruleid: auth.nextauth.debug-enabled
  debug: true,
});
SAFE
safe.ts
import NextAuth from 'next-auth';
import type { NextAuthConfig } from 'next-auth';

export const authConfig: NextAuthConfig = {
  providers: [],
  // ok: auth.nextauth.debug-enabled -- gated on the environment, off in production
  debug: process.env.NODE_ENV !== 'production',
};

export const { handlers } = NextAuth({
  providers: [],
  // ok: auth.nextauth.debug-enabled -- left unset, defaults to off
});

// ok: auth.nextauth.debug-enabled -- unrelated options object, not a NextAuth config
const buildOptions = {
  debug: true,
};

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.nextauth.debug-enabled -- <reason>

References

https://authjs.dev/reference/core#debug ↗https://cwe.mitre.org/data/definitions/489.html ↗