Checks · HYG-004

HYG-004 · Debug or test routes left in production

Why it matters

A /debug or /test route often skips auth or returns internal data.

How we detect it

Those paths return a successful response that is not your normal page.

How we fix it

Remove the route or guard it so it only exists in development.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-007 · Source maps public in production
• DB-008 · Migrations not in repo
• HDR-001 · Missing HSTS
• HDR-002 · Missing CSP