v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: HIGH auth.py.flow.debug-enabled

Debug mode is hard-coded to True.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

In production this leaks the SECRET_KEY, environment variables, and full tracebacks, and Flask's Werkzeug debugger additionally exposes an interactive console that allows remote code execution.

Never enable debug mode in production. Drive it from an environment variable that defaults to off, e.g. debug=os.environ.get("FLASK_DEBUG") == "1" (Flask) or DEBUG = os.environ.get("DJANGO_DEBUG") == "1" (Django).

VULNERABLE
vulnerable.py
from flask import Flask

app = Flask(__name__)


def serve():
    # ruleid: auth.py.flow.debug-enabled
    app.run(host="0.0.0.0", debug=True)


def configure():
    # ruleid: auth.py.flow.debug-enabled
    app.config["DEBUG"] = True


def configure_attr():
    # ruleid: auth.py.flow.debug-enabled
    app.debug = True


# ruleid: auth.py.flow.debug-enabled
DEBUG = True
SAFE
safe.py
import os

from flask import Flask

app = Flask(__name__)


# ok: auth.py.flow.debug-enabled -- debug not enabled at all
def serve():
    app.run(host="127.0.0.1")


# ok: auth.py.flow.debug-enabled -- explicitly disabled
def serve_no_debug():
    app.run(host="127.0.0.1", debug=False)


# ok: auth.py.flow.debug-enabled -- driven by an environment variable
def serve_env():
    app.run(debug=os.environ.get("FLASK_DEBUG") == "1")


# ok: auth.py.flow.debug-enabled -- disabled in production settings
DEBUG = False

# ok: auth.py.flow.debug-enabled -- read from the environment, defaults off
DJANGO_DEBUG = os.environ.get("DJANGO_DEBUG") == "1"

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

# oauthlint-disable-next-line auth.py.flow.debug-enabled -- <reason>

References

https://flask.palletsprojects.com/en/stable/config/#DEBUG ↗https://docs.djangoproject.com/en/stable/ref/settings/#debug ↗https://cwe.mitre.org/data/definitions/489.html ↗