Things that get left behind
- Routes such as /debug, /test, /seed or /api/dev that return internal state.
- Admin pages protected only by an unlisted URL.
- Framework debug modes and detailed stack traces in error responses.
- Sample accounts with default passwords and seed data with real-looking records.
Audit your routes
- Print the route list from your framework and read each entry.
- Search the code for words such as debug, seed, test and admin.
- For each route, ask who may call it and where that is enforced on the server.
Gate by environment
if (process.env.NODE_ENV === 'production') {
return new Response('Not found', { status: 404 });
}Quiet errors for users
Return a short message and an error id to the user, and keep stack traces in your logs.
Frequently asked questions
Is a hard-to-guess admin URL enough?
No. URLs leak through logs, referrers and shared links. Enforce a role check on the server.