Analytics debug mode is disabled in production
Why it matters
Debug mode sends extra diagnostic events, enables verbose console output, routes events to GA4 DebugView, and can expose internal event schemas and user property names in the browser console. Shipped to production it pollutes the real data stream with test events, inflates event counts by double-digit percentages, and leaks implementation detail visible in DevTools. Every downstream report based on that data is contaminated for as long as debug mode stayed on.
Severity rationale
High because unguarded debug mode silently corrupts production analytics data and leaks implementation detail.
Remediation
Gate every debug toggle on NODE_ENV:
posthog.init(process.env.NEXT_PUBLIC_POSTHOG_KEY, {
loaded: (ph) => { if (process.env.NODE_ENV === 'development') ph.debug() }
})
For GA4: gtag('config', 'G-XXXXXXX', { debug_mode: process.env.NODE_ENV === 'development' }). After deploying, check GA4 DebugView in the live dashboard — it should show zero production hostnames. Audit components/AnalyticsProvider.tsx first since that is where most of these flags live.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Analytics & Tracking Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
Taxons
History
- 2026-04-18·v1.0.0·Initial import from marketing-analytics·automated