Skip to main content

Disable Django Debug Mode

pixee:python/django-debug-flag-on

ImportanceReview GuidanceRequires Scanning Tool
MediumMerge After Cursory ReviewNo

This codemod will flip django's DEBUG flag to False if it's True on the settings.py file within django's default directory structure.

Having the debug flag on may result in sensitive information exposure. When an exception occurs while the DEBUG flag in on, it will dump metadata of your environment, including the settings module. The attacker can purposefully request a non-existing url to trigger an exception and gather information about your system.

- DEBUG = True
+ DEBUG = False

If you have feedback on this codemod, please let us know!

F.A.Q.

Why is this codemod marked as Merge After Cursory Review?

Django's DEBUG flag may be overridden somewhere else or the runtime settings file may be set with the DJANGO_SETTINGS_MODULE environment variable. This means that the DEBUG flag may intentionally be left on as a development aid.

Codemod Settings

N/A

References