Secrets and config
Debug or test-mode configuration reaches production
Test-mode payment keys, verbose logging or seed data run in production because the configuration was copied from development.
Termsclient bundle (the JavaScript your app sends to the browser or ships inside the mobile app; anyone can read it) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server) · security headers (HTTP response headers (HSTS, content-type, frame policy) that switch on the browser's built-in protections) · CI (the pipeline that builds and tests every change before it can be merged or deployed)
highseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Configuration written to make a feature work locally is carried through unchanged; the 15-app study found none of the generated apps set production security headers, a sign that production hardening is not part of the generated default.
Five coding agents built 15 identical applications from the same prompts; the applications contained 69 vulnerabilities in total, every agent produced at least one server-side request forgery, none of the 15 applications had CSRF protection or security headers, and every login page shipped without rate limiting or account lockout.
Source: Tenzai, 2026-01 · verified 2026-09-21
How we detect it
Compare the production environment to a written list of production-only settings on every release.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
Production runs with production configuration
manual Compare the production environment against a written list: debug flags off, test-mode API keys absent, sample data seeding disabled, verbose logging off.
Every entry on the production configuration list matches; no test-mode key or debug flag is present.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in secrets and config
- critical
- critical
- critical
- high
- medium
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.