From bbc7c4ea4e32c284b696f6d8e2d070c83eec1d39 Mon Sep 17 00:00:00 2001 From: Naman Singh Date: Fri, 17 Jul 2026 12:56:35 +0530 Subject: [PATCH 1/2] fix(security): disable debug mode defaults and conditional docs (#2036) The application defaulted to debug=True, causing: 1. Full Python tracebacks returned as HTML on unhandled exceptions 2. OpenAPI docs always exposed at /docs and /openapi.json 3. Uvicorn hot-reload enabled in production Fix: - Change debug default from True to False in config.py - Conditionally disable docs/redoc/openapi endpoints when debug=False - Conditionally skip /api/docs redirect routes when debug=False - Update .env.example to reflect safe default (SECUSCAN_DEBUG=false) --- .env.example | 2 +- backend/secuscan/config.py | 2 +- backend/secuscan/main.py | 35 ++++++++++++++++++----------------- 3 files changed, 20 insertions(+), 19 deletions(-) diff --git a/.env.example b/.env.example index 0e16e2c1a..0d4e08f97 100644 --- a/.env.example +++ b/.env.example @@ -2,7 +2,7 @@ # Copy this file to `.env` and adjust values for your local setup. # Backend Settings -SECUSCAN_DEBUG=true +SECUSCAN_DEBUG=false SECUSCAN_LOG_LEVEL=INFO SECUSCAN_BIND_ADDRESS=127.0.0.1 SECUSCAN_BIND_PORT=8000 diff --git a/backend/secuscan/config.py b/backend/secuscan/config.py index e37be8543..757ca3ac9 100644 --- a/backend/secuscan/config.py +++ b/backend/secuscan/config.py @@ -19,7 +19,7 @@ class Settings(BaseSettings): # Server Configuration bind_address: str = "127.0.0.1" bind_port: int = 8000 - debug: bool = True + debug: bool = False # Primary data store database_path: str = str(PROJECT_ROOT / "data" / "secuscan.db") diff --git a/backend/secuscan/main.py b/backend/secuscan/main.py index 66282c415..c69570704 100644 --- a/backend/secuscan/main.py +++ b/backend/secuscan/main.py @@ -167,26 +167,27 @@ async def lifespan(app: FastAPI): title="SecuScan API", description="Backend for SecuScan Pentesting Toolkit", version="1.0.0", - docs_url="/docs", - redoc_url="/redoc", - openapi_url="/openapi.json", + docs_url="/docs" if settings.debug else None, + redoc_url="/redoc" if settings.debug else None, + openapi_url="/openapi.json" if settings.debug else None, lifespan=lifespan ) -@app.get("/api/docs", include_in_schema=False) -async def redirect_api_docs(): - from fastapi.responses import RedirectResponse - return RedirectResponse(url="/docs") - -@app.get("/api/redoc", include_in_schema=False) -async def redirect_api_redoc(): - from fastapi.responses import RedirectResponse - return RedirectResponse(url="/redoc") - -@app.get("/api/openapi.json", include_in_schema=False) -async def redirect_api_openapi(): - from fastapi.responses import RedirectResponse - return RedirectResponse(url="/openapi.json") +if settings.debug: + @app.get("/api/docs", include_in_schema=False) + async def redirect_api_docs(): + from fastapi.responses import RedirectResponse + return RedirectResponse(url="/docs") + + @app.get("/api/redoc", include_in_schema=False) + async def redirect_api_redoc(): + from fastapi.responses import RedirectResponse + return RedirectResponse(url="/redoc") + + @app.get("/api/openapi.json", include_in_schema=False) + async def redirect_api_openapi(): + from fastapi.responses import RedirectResponse + return RedirectResponse(url="/openapi.json") # CORS middleware cors_allow_all = "*" in settings.cors_allowed_origins From 9cb8eaa958fc119f93f6f8fed7b4d36b75aa1dcf Mon Sep 17 00:00:00 2001 From: Naman Singh Date: Fri, 17 Jul 2026 15:48:07 +0530 Subject: [PATCH 2/2] fix(dev): export SECUSCAN_DEBUG=true in start.sh dev launcher The dev workflow in start.sh advertises /docs, /redoc, and /openapi.json but never sets SECUSCAN_DEBUG. With the new default of debug=False, these routes 404 unless developers manually set the env var. Export SECUSCAN_DEBUG=true before launching uvicorn so the dev server has full API docs and hot-reload. --- start.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/start.sh b/start.sh index f582f9516..41402c7b1 100755 --- a/start.sh +++ b/start.sh @@ -86,6 +86,8 @@ pip install -q -r backend/requirements.txt mkdir -p "$ROOT_DIR/data" "$ROOT_DIR/logs" echo "🚀 Starting backend on http://127.0.0.1:8000" +# Dev workflow needs debug=True for /docs, /redoc, and hot-reload +export SECUSCAN_DEBUG=true python -m uvicorn backend.secuscan.main:app \ --host 127.0.0.1 \ --port 8000 \