Do not expose debug routes or middleware in production
Debug handlers, stack-showing middleware, and diagnostic endpoints should stay behind explicit development-only guards.
#Metadata
#Why it matters
Debug endpoints and stack-showing middleware can disclose internal topology, environment details, and request data with very little attacker effort.
#Remediation
Wrap the registration in an explicit development-only guard or remove the endpoint or middleware from production builds.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.debug-mode-enabled.rule.yaml.