Secure defaults enforced in production

Development conveniences left enabled in production — debug modes, verbose stack traces in error responses, wildcard CORS, authentication bypasses — are a class of security misconfiguration documented by CWE-1188 (Insecure Default Initialization) and OWASP A05 (Security Misconfiguration). NIST 800-53 CM-6 requires baseline configurations to be documented and enforced. A /api/debug/users route that bypasses auth and returns all user records, or a productionBrowserSourceMaps: true setting that ships full TypeScript source to browsers, represents a failure mode that is easy to introduce during development and easy to forget to remove.

Gate all development conveniences behind explicit NODE_ENV checks and set secure defaults unconditionally in next.config.ts:

// next.config.ts
export default {
  productionBrowserSourceMaps: false,  // No source maps shipped to browsers
  poweredByHeader: false,              // Don't advertise Next.js version
}

// Remove or gate development middleware:
if (process.env.NODE_ENV === 'development') {
  app.use(require('morgan')('dev'))
}

// Default-deny for protected routes:
const PUBLIC_ROUTES = new Set(['/api/auth/login', '/api/health'])
if (!PUBLIC_ROUTES.has(req.path) && !req.user) {
  return res.status(401).json({ error: 'Unauthorized' })
}

Search for if (process.env.NODE_ENV !== 'production') — any security bypass inside that block is a vulnerability.