Debug routes that dump your secrets to strangers
A /api/debug or /swagger page that returns process.env looks handy while building. In production it hands attackers your database URLs, API keys, and signing secrets in one JSON response.
What can go wrong
Debug routes are scaffolding endpoints AI adds for local troubleshooting: return environment variables, echo config, or expose an API playground without login.
vibe-eval catalogs this as pattern #13: roughly 35% of vibe-coded apps ship reachable debug or admin paths to production (vibe-eval 14 patterns). Common shapes:
/api/debugreturningResponse.json(process.env)- Unauthenticated
/swaggeror/playgroundin prod /api/testor/api/health/fullechoing connection strings
Wrapping the handler in if (process.env.NODE_ENV !== 'production') still ships the file. Attackers probe the path anyway.
It happened for real
CheckVibe's secure-vibe-coded-app guide documents AI-generated handlers that return process.env and database URLs on /api/debug, /api/test, and /api/health (CheckVibe secure guide). The ASA Standard lists /api/debug, /api/test, /api/seed, and /admin returning environment data as a named failure class (ASA exposed debug/admin routes).
How to check yours
Seatbelt flags part of this automatically. Repo scans soft-flag /api/debug paths that return environment dumps. URL Ship Read can catch swagger-ui assets, env-shaped JSON, and debug path hints in the outside view.
Honest holes: /api/test and some playground paths are still expanding on the repo walker (improve #41). A soft flag on /api/debug is the signal we have today; read sibling paths yourself.
Ask your agent: "List every route under /api/debug, /swagger, /playground, /api/test, and /api/health. Does any return process.env, connection strings, or config objects without admin auth?"
Manual check: curl your deployed app's /api/debug and /swagger paths while signed out. If you get JSON with keys or env-shaped fields, delete the route.
Fix direction
Delete the debug route file entirely. Rotating keys after an env dump is mandatory, but removal comes first.
Paste into your agent: "Remove every debug, swagger, and test route that returns environment variables or config. Delete the files; do not NODE_ENV-gate them in place."