---
title: "WEB-PY-001 Django Debug Mode Enabled"
canonical: https://openvapt.com/checks/WEB-PY-001.html
html: https://openvapt.com/checks/WEB-PY-001.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-PY-001 Django Debug Mode Enabled

Checks Django settings files for DEBUG = True with no production override.

- Domain: Web Apps
- Severity: High
- Control category: Information Exposure
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
- CIS Controls v8: 16.7
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-489, CWE-215
- OWASP Top 10 2021: A05:2021
- OWASP ASVS 4.0.3: 14.3.2
- OWASP WSTG v4.2: WSTG-ERRH-01
- NIST SP 800-53 Rev. 5: CM-6

## Why It Matters

With DEBUG on, every error page shows source code, local variables, SQL queries and most settings, and Django keeps every SQL query in memory. Attackers trigger errors on purpose to read them.

## How It Detects

Finds settings.py and settings/*.py files that look like Django settings in /srv, /opt, /var/www, home directories and web roots (three folders deep), and fails when a folder sets DEBUG = True and no file in the same folder sets DEBUG = False or reads it from the environment.

## How to Fix

Set DEBUG = False in production, preferably from the environment (DEBUG = os.environ.get('DJANGO_DEBUG') == '1'), set ALLOWED_HOSTS, and restart the application. Run python manage.py check --deploy.

## How to Verify

```
python manage.py check --deploy  reports no DEBUG warning.
```

## Learn the Theory

- [P13 Application Servers: Tomcat, Node.js and Python](https://openvapt.com/academy/p13.md)

## References

- [Django documentation, Deployment checklist](https://docs.djangoproject.com/en/6.1/howto/deployment/checklist/)
- [Django settings reference, DEBUG](https://docs.djangoproject.com/en/6.1/ref/settings/#debug)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/runtimes.go

Run it: `openvapt scan --only WEB-PY-001`. Read it offline: `openvapt explain WEB-PY-001`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-PY-001.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.