Will It Vibe?DEBUG = True in a production-looking settings file
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
Django's debug page dumps a full traceback, the offending source lines, every local variable at each frame, and the values of all settings (including secrets that are not on its scrub list) for any unhandled exception. This check is a heuristic: it skips files whose name or directory looks like a dev/local/test settings variant, where DEBUG = True is expected.
Why it matters
Django's debug page renders a full traceback with the exact source lines, every local variable at each stack frame, and the values of most settings for any unhandled exception. Left on in production, the very first bug a visitor triggers hands them a map of the codebase, and sometimes secrets that are not on Django's scrub list. DEBUG = True is also what Django's startproject scaffold ships with, so it is easy to forget to flip.
How to fix it
Set DEBUG = False in the settings module actually loaded in production, and drive it from an environment variable (DEBUG = os.environ.get("DJANGO_DEBUG", "False") == "True") rather than a literal, so it defaults safely closed. Run python manage.py check --deploy against the production settings to confirm.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo