Django

DEBUG=True in production exposes sensitive application internals

critical
securityUpdated Mar 2, 2026(via Exa)
Sources
Common Django Security Mistakes | Django wiki | Mediummedium.com
Technologies:
Djangosubject
How to detect:

Django DEBUG setting is enabled in production environment, exposing stack traces, settings values, and potentially sensitive data to end users and attackers.

Recommended action:

Set DEBUG=False in production. Use environment variables: DEBUG = os.getenv("DJANGO_DEBUG", "0") == "1". Add runtime check: if not SECRET_KEY: raise RuntimeError("DJANGO_SECRET_KEY is not set"). Ensure proper logging is configured so you don't need DEBUG for troubleshooting.