Feature flags are environment-specific

Feature flags hardcoded in source code or set to the same value across all environments create two distinct risks: debug panels, admin shortcuts, and incomplete features ship to production, and toggling them requires a code change and redeployment rather than a configuration update. OWASP A05 (Security Misconfiguration) and CWE-1188 both flag hardcoded defaults as a misconfiguration class. A debug panel exposed in production can leak stack traces, internal routes, or database query details. A payment feature flag stuck at true in staging that also runs in production will charge real customers for test transactions.

Replace hardcoded flag values with environment variable checks or a feature flag service. The flag evaluation must differ between environments — checking only NODE_ENV is sufficient for simple cases; use a service like LaunchDarkly or Unleash for runtime toggling without redeployment.

// BEFORE (wrong)
const DEBUG_MODE = true

// AFTER (correct) — environment variable + NODE_ENV guard
const DEBUG_MODE =
  process.env.NODE_ENV !== 'production' &&
  process.env.ENABLE_DEBUG === 'true'

// AFTER (correct) — feature flag service
import { isEnabled } from '@unleash/nextjs'
const debugEnabled = await isEnabled('debug-panel')

Verify that every flag evaluates to false in production by running the production config locally and asserting against each flag name.