No debug routes active in production

Debug routes left without environment gates are live attack surface. They commonly dump internal state — full user tables, environment variables, session stores, database query results — to anyone who discovers them. OWASP A05:2021 (Security Misconfiguration) and CWE-489 (Active Debug Code) both cover this: the misconfiguration is shipping development tooling as production infrastructure. Discovery is trivial: common debug path patterns (/api/debug, /api/test, /playground) are in every web scanner wordlist, and AI-generated projects tend to follow identical naming conventions.

Either delete the route file entirely, or add an explicit production gate as the first statement in the handler. In app/api/debug/route.ts or app/playground/page.tsx:

export async function GET() {
  if (process.env.NODE_ENV === 'production') {
    return new Response(null, { status: 404 })
  }
  // debug logic below
}

Prefer deletion over gating — a 404 in prod still confirms the route exists to a scanner. Walk all route files matching /api/debug, /api/test, /api/__dev__, /api/dev, /debug, /playground, and /dev-tools path segments and either remove them or verify they are gated at the middleware layer (src/middleware.ts) with a hard NODE_ENV check.