---
title: "WEB-APP-003 Symfony Running in the Development Environment"
canonical: https://openvapt.com/checks/WEB-APP-003.html
html: https://openvapt.com/checks/WEB-APP-003.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-APP-003 Symfony Running in the Development Environment

Checks Symfony .env files for APP_ENV=dev or APP_DEBUG=1.

- Domain: Web Apps
- Severity: High
- Control category: Information Exposure
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
- CIS Controls v8: 16.7
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-489, CWE-215
- OWASP Top 10 2021: A05:2021
- OWASP ASVS 4.0.3: 14.3.2
- OWASP WSTG v4.2: WSTG-CONF-02, WSTG-ERRH-01
- NIST SP 800-53 Rev. 5: CM-6, SI-11

## Why It Matters

The dev environment enables the web profiler and debug toolbar, which show requests, queries, configuration, the container and sometimes credentials to any visitor, and it skips the caches that production relies on.

## How It Detects

Finds .env files that contain APP_SECRET (the Symfony marker) and fails when APP_ENV is dev or test, or APP_DEBUG is 1 or true. A .env.local or .env.prod override is not evaluated, so confirm the final value on the server.

## How to Fix

Set APP_ENV=prod and APP_DEBUG=0 in .env (or .env.local), run composer dump-env prod, clear the cache (php bin/console cache:clear) and remove the web profiler bundle from production.

## How to Verify

```
php bin/console about  shows Environment prod and Debug false.
```

## Learn the Theory

- [A6 Application Framework and CMS Configuration](https://openvapt.com/academy/a6.md)

## References

- [Symfony documentation, Configuring Symfony (environments)](https://symfony.com/doc/current/configuration.html)
- [Symfony documentation, How to Deploy a Symfony Application](https://symfony.com/doc/current/deployment.html)
- [OWASP ASVS 4.0.3, V14 Configuration](https://github.com/OWASP/ASVS/blob/v4.0.3/4.0/en/0x22-V14-Config.md)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/frameworks.go

Run it: `openvapt scan --only WEB-APP-003`. Read it offline: `openvapt explain WEB-APP-003`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-APP-003.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.