fix(security): disable debug mode defaults and conditional docs [#2036]

[namann5]

Summary

Disable debug mode by default and conditionally hide API documentation endpoints in production to prevent sensitive data exposure.

Closes #2036

Problem

The application defaulted to debug: bool = True, causing three critical information disclosure issues:

1. Full tracebacks as HTML on any unhandled exception — exposing internal file paths, database schema, library versions
2. OpenAPI docs always accessible at /docs, /redoc, /openapi.json — giving attackers a complete endpoint map
3. Uvicorn hot-reload enabled — watching all source files, exploitable for side-channel timing attacks

The .env.example also reinforced this with SECUSCAN_DEBUG=true.

Fix (3 files)

1. backend/secuscan/config.py

# Before
debug: bool = True

# After
debug: bool = False  # must be explicitly enabled

2. backend/secuscan/main.py

Conditionally disable docs endpoints when debug is off:

app = FastAPI(
    ...,
    docs_url="/docs" if settings.debug else None,
    redoc_url="/redoc" if settings.debug else None,
    openapi_url="/openapi.json" if settings.debug else None,
    ...
)

The /api/docs, /api/redoc, and /api/openapi.json redirect routes are also only registered when settings.debug is True.

3. .env.example

# Before
SECUSCAN_DEBUG=true

# After
SECUSCAN_DEBUG=false

Impact

• Before: Tracebacks leaked on errors, OpenAPI schema always exposed, reload always active
• After: Generic "Internal Server Error" in production, docs endpoints return 404, no reload unless explicitly enabled

Labels

type:security, level:critical, priority:high, area:backend

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bbc7c4ea4e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve OpenAPI docs for dev startup

When using the documented dev workflow, start.sh invokes python -m uvicorn backend.secuscan.main:app --reload and advertises /docs, but it never exports SECUSCAN_DEBUG and Settings does not load .env automatically. With the new default False, these routes are not registered at import time, so the advertised local Swagger/ReDoc/OpenAPI URLs 404 unless developers know to set SECUSCAN_DEBUG=true manually; use a separate production/docs flag or have the dev launcher explicitly enable debug/docs.

Useful? React with 👍 / 👎.

[utksh1]

Rebased with main to pick up test fixes from #2040 and #2041. The backend-unit test failures should be resolved now.

[utksh1]

Excellent security fix addressing the debug mode information disclosure vulnerability (#2036).

Changes:

• ✅ Debug defaults to False (was True)
• ✅ OpenAPI docs disabled in production (conditionally enabled only when debug=True)
• ✅ .env.example updated with safe defaults

This prevents:

• Full traceback exposure in production
• OpenAPI endpoint mapping leakage
• Uvicorn hot-reload in production

Rebased with main to include test fixes. Approving for merge.