# debug_prescan report

files scanned: 11 — findings: 31

## HIGH
- `DBG-DEBUG-ON` hostile/.env.production:1 — debug flag set truthy in a settings/config/env file — the deploy shape this file feeds runs with debug on
- `DBG-STACK-TO-CLIENT` hostile/app.js:8 — exception internals written into the HTTP response — client receives file paths, queries, framework internals
- `DBG-ENV-DUMP` hostile/app.js:11 — environment structure sent to the client — env usually carries credentials and connection strings
- `DBG-DEBUG-ON` hostile/env.rb:2 — debug mode enabled at the app entrypoint / prod config — full error pages, reloaders, or an interactive console ship to users
- `DBG-DEBUG-ON` hostile/env.rb:3 — debug mode enabled at the app entrypoint / prod config — full error pages, reloaders, or an interactive console ship to users
- `DBG-DEV-CONSOLE` hostile/index.php:4 — interactive debug console or full-environment disclosure reachable (DebuggedApplication / phpinfo / Whoops pretty page)
- `DBG-STACK-TO-CLIENT` hostile/index.php:5 — exception internals written into the HTTP response — client receives file paths, queries, framework internals
- `DBG-ENV-DUMP` hostile/index.php:6 — environment structure sent to the client — env usually carries credentials and connection strings
- `DBG-DEBUG-ON` hostile/settings.py:2 — debug flag set truthy in a settings/config/env file — the deploy shape this file feeds runs with debug on
- `DBG-DEBUG-ON` hostile/settings.py:7 — debug mode enabled at the app entrypoint / prod config — full error pages, reloaders, or an interactive console ship to users
- `DBG-DEV-CONSOLE` hostile/settings.py:10 — interactive debug console or full-environment disclosure reachable (DebuggedApplication / phpinfo / Whoops pretty page)
- `DBG-STACK-TO-CLIENT` hostile/settings.py:17 — exception internals written into the HTTP response — client receives file paths, queries, framework internals
- `DBG-DEBUG-ON` hostile/web.config:4 — debug mode enabled at the app entrypoint / prod config — full error pages, reloaders, or an interactive console ship to users
## MEDIUM
- `DBG-VERBOSE-ERR` hostile/app.js:6 — verbose error display configured — stack traces / error detail rendered to the response
- `DBG-DEBUG-PARAM` hostile/app.js:14 — request-controlled 'debug' switch — an attacker can flip whatever this gates; verify the output it unlocks
- `DBG-ACTUATOR` hostile/application.properties:2 — Spring actuator exposure widened — heapdump/env/beans/threaddump endpoints leak internals unauthenticated
- `DBG-ACTUATOR` hostile/application.properties:3 — Spring actuator exposure widened — heapdump/env/beans/threaddump endpoints leak internals unauthenticated
- `DBG-VERBOSE-ERR` hostile/application.properties:4 — verbose error display configured — stack traces / error detail rendered to the response
- `DBG-DEV-CONSOLE` hostile/env.rb:4 — debug toolbar/console/profiler package wired in — verify it never reaches a production build
- `DBG-VERBOSE-ERR` hostile/index.php:3 — verbose error display configured — stack traces / error detail rendered to the response
- `DBG-DEBUG-PARAM` hostile/index.php:9 — request-controlled 'debug' switch — an attacker can flip whatever this gates; verify the output it unlocks
- `DBG-PPROF` hostile/main.go:5 — Go pprof registered — /debug/pprof/* serves goroutine/heap/CPU profiles without auth
- `DBG-DEV-CONSOLE` hostile/settings.py:3 — debug toolbar/console/profiler wired in — verify it never reaches a production build
- `DBG-VERBOSE-ERR` hostile/settings.py:4 — verbose error display configured — stack traces / error detail rendered to the response
- `DBG-VERBOSE-ERR` hostile/web.config:5 — verbose error display configured — stack traces / error detail rendered to the response
## LOW
- `DBG-BREAKPOINT` hostile/app.js:19 — stale breakpoint — hangs the request thread or drops an interactive console
- `DBG-DEV-DUMP` hostile/index.php:6 — dev dump call left in PHP app code — internals leak to the page
- `DBG-DEV-DUMP` hostile/index.php:7 — dev dump call left in PHP app code — internals leak to the page
- `DBG-DEV-DUMP` hostile/index.php:8 — dev dump call left in PHP app code — internals leak to the page
- `DBG-DEV-DUMP` hostile/index.php:9 — dev dump call left in PHP app code — internals leak to the page
- `DBG-BREAKPOINT` hostile/settings.py:20 — stale breakpoint — hangs the request thread or drops an interactive console