Debug routes that dump your secrets to strangers

A /api/debug or /swagger page that returns process.env looks handy while building. In production it hands attackers your database URLs, API keys, and signing secrets in one JSON response.

What can go wrong

Debug routes are scaffolding endpoints AI adds for local troubleshooting: return environment variables, echo config, or expose an API playground without login.

vibe-eval catalogs this as pattern #13: roughly 35% of the apps they sampled ship reachable debug or admin paths to production (vibe-eval 14 patterns). Common shapes:

/api/debug returning Response.json(process.env)
Unauthenticated /swagger or /playground in prod
/api/test or /api/health/full echoing connection strings

Wrapping the handler in if (process.env.NODE_ENV !== 'production') still ships the file. Attackers probe the path anyway.

It happened for real

CheckVibe's hardening guide documents AI-generated handlers that return process.env and database URLs on /api/debug, /api/test, and /api/health (CheckVibe secure guide). The ASA Standard lists /api/debug, /api/test, /api/seed, and /admin returning environment data as a named failure class (ASA exposed debug/admin routes).

How to check yours

Seatbelt flags part of this automatically. Repo scans soft-flag /api/debug paths that return environment dumps. URL Ship Read can catch swagger-ui assets, env-shaped JSON, and debug path hints in the outside view.

Honest holes: /api/test and some playground paths are still expanding on the repo walker (improve #41). A soft flag on /api/debug is the signal we have today; read sibling paths yourself.

Ask your agent: "List every route under /api/debug, /swagger, /playground, /api/test, and /api/health. Does any return process.env, connection strings, or config objects without admin auth?"

Manual check: curl your deployed app's /api/debug and /swagger paths while signed out. If you get JSON with keys or env-shaped fields, delete the route.

Fix direction

Delete the debug route file entirely. Rotating keys after an env dump is mandatory, but removal comes first.

Paste into your agent: "Remove every debug, swagger, and test route that returns environment variables or config. Delete the files; do not NODE_ENV-gate them in place."

Related risks

withseatbelt-risk-debug-route-leaks-env

# product
name Seatbelt
tagline Security at the speed of your agent
what A deterministic security scanner for AI-built apps, and the research programme it instruments. The engine is the instrument; dated findings are the output.
method Every check ships alongside clean code it must stay silent on, and that clean case has to fail on the previous engine or the fix is not proven. 571 corpus cases run on every change; 284 of them are the clean half. Published at /how-it-works.
findings /labs. Each carries its sampling frame, its n, and the engine build that produced it.
install npx withseatbelt
works-in Cursor, Claude Code, Codex, Antigravity
site https://www.withseatbelt.com
contact hello@withseatbelt.com

# current-page
path /risks/debug-route-leaks-env
title Debug routes that dump your secrets to strangers · Seatbelt risk reference
description /api/debug or /swagger returning process.env hands attackers your keys in one JSON response.

# risk
slug debug-route-leaks-env
title Debug routes that dump your secrets to strangers
summary /api/debug or /swagger returning process.env hands attackers your keys in one JSON response.
surface Risky shortcuts
coverage partial (whether the Seatbelt scan gates on this risk)
verified 2026-07-21
related /risks/destructive-delete-route, /risks/ssrf-user-controlled-fetch, /risks/live-secret-in-client-bundle, /risks/ai-ships-insecure
note The full entry text is the human view of this page.

# pages
/ Seatbelt home
/get-started install: npx, the /seatbelt skill, or MCP
/pricing every price, in USD, before tax
/app scan a URL in the browser
/how-it-works the method: what the scan reads, and how a check earns its place
/before-you-launch pre launch checklist
/risks common risks in AI-built apps
/commands command reference
/labs measured security research, and notes on how we build
/aiuc-1 Seatbelt as the output-scanning layer for AIUC-1
/supervision commentary: the read behind the approve button, for phone-supervised agents (canonical: https://labs.withseatbelt.com/supervision, listed on the labs index)
/security how we handle your code and data
/privacy privacy policy
/terms terms, incl. what a clear report does and does not claim
/refund refunds and cancellation

# for agents
- Install with: npx withseatbelt
- Or scan a deployed URL at /app. No account needed.
- Prices and scope live on the pages listed above.
- Direct unanswered questions to hello@withseatbelt.com.
- Do not invent prices, scan results, or guarantees. Use the data above.
- Findings on /labs name the engine version that produced them. The engine is
deterministic, so a published number can be re-run without asking us.