diff --git a/.env.example b/.env.example
index 0e16e2c1a..0d4e08f97 100644
--- a/.env.example
+++ b/.env.example
@@ -2,7 +2,7 @@
 # Copy this file to `.env` and adjust values for your local setup.
 
 # Backend Settings
-SECUSCAN_DEBUG=true
+SECUSCAN_DEBUG=false
 SECUSCAN_LOG_LEVEL=INFO
 SECUSCAN_BIND_ADDRESS=127.0.0.1
 SECUSCAN_BIND_PORT=8000
diff --git a/backend/secuscan/config.py b/backend/secuscan/config.py
index e37be8543..757ca3ac9 100644
--- a/backend/secuscan/config.py
+++ b/backend/secuscan/config.py
@@ -19,7 +19,7 @@ class Settings(BaseSettings):
     # Server Configuration
     bind_address: str = "127.0.0.1"
     bind_port: int = 8000
-    debug: bool = True
+    debug: bool = False
 
     # Primary data store
     database_path: str = str(PROJECT_ROOT / "data" / "secuscan.db")
diff --git a/backend/secuscan/main.py b/backend/secuscan/main.py
index 66282c415..c69570704 100644
--- a/backend/secuscan/main.py
+++ b/backend/secuscan/main.py
@@ -167,26 +167,27 @@ async def lifespan(app: FastAPI):
     title="SecuScan API",
     description="Backend for SecuScan Pentesting Toolkit",
     version="1.0.0",
-    docs_url="/docs",
-    redoc_url="/redoc",
-    openapi_url="/openapi.json",
+    docs_url="/docs" if settings.debug else None,
+    redoc_url="/redoc" if settings.debug else None,
+    openapi_url="/openapi.json" if settings.debug else None,
     lifespan=lifespan
 )
 
-@app.get("/api/docs", include_in_schema=False)
-async def redirect_api_docs():
-    from fastapi.responses import RedirectResponse
-    return RedirectResponse(url="/docs")
-
-@app.get("/api/redoc", include_in_schema=False)
-async def redirect_api_redoc():
-    from fastapi.responses import RedirectResponse
-    return RedirectResponse(url="/redoc")
-
-@app.get("/api/openapi.json", include_in_schema=False)
-async def redirect_api_openapi():
-    from fastapi.responses import RedirectResponse
-    return RedirectResponse(url="/openapi.json")
+if settings.debug:
+    @app.get("/api/docs", include_in_schema=False)
+    async def redirect_api_docs():
+        from fastapi.responses import RedirectResponse
+        return RedirectResponse(url="/docs")
+
+    @app.get("/api/redoc", include_in_schema=False)
+    async def redirect_api_redoc():
+        from fastapi.responses import RedirectResponse
+        return RedirectResponse(url="/redoc")
+
+    @app.get("/api/openapi.json", include_in_schema=False)
+    async def redirect_api_openapi():
+        from fastapi.responses import RedirectResponse
+        return RedirectResponse(url="/openapi.json")
 
 # CORS middleware
 cors_allow_all = "*" in settings.cors_allowed_origins
diff --git a/start.sh b/start.sh
index f582f9516..41402c7b1 100755
--- a/start.sh
+++ b/start.sh
@@ -86,6 +86,8 @@ pip install -q -r backend/requirements.txt
 mkdir -p "$ROOT_DIR/data" "$ROOT_DIR/logs"
 
 echo "🚀 Starting backend on http://127.0.0.1:8000"
+# Dev workflow needs debug=True for /docs, /redoc, and hot-reload
+export SECUSCAN_DEBUG=true
 python -m uvicorn backend.secuscan.main:app \
   --host 127.0.0.1 \
   --port 8000 \