No dev-only feature flags hardcoded to true
Why it matters
A module-scope const DEBUG = true survives every environment because it is never read from process.env. Debug logs spew into production, verbose error messages leak internal structure, SKIP_AUTH bypasses middleware, and MOCK_PAYMENTS routes real checkouts to fakes. These constants ship because AI sets them to true during scaffolding and never parameterizes them, and linters do not flag boolean literals.
Severity rationale
Low because the flags rarely expose data directly, but they can enable debug paths, skipped checks, or mock flows in production.
Remediation
Drive every dev-pattern flag from process.env with an explicit fallback, and centralize flag resolution so the check is obvious in review. Fix at src/lib/logger.ts:
const DEBUG = process.env.DEBUG === '1' || process.env.NODE_ENV === 'development'
const SKIP_AUTH = process.env.SKIP_AUTH === '1' && process.env.NODE_ENV !== 'production'
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the WIP-in-Production Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ai-slop-half-finished·automated