Description

Detects when debugging is enabled in Docker configurations, which could expose sensitive information about the container or application. Debugging modes should be disabled in production environments as they can leak internal details that attackers could exploit.

Detection Strategy

• Search Dockerfile content for configuration lines that enable debugging

• Flag any instances where debug mode is explicitly enabled

• Check for debug-related environment variables or build arguments being set

Vulnerable code example

# Vulnerable: activa depuración
ENV APP_DEBUG=true
# Ejecuta /run.sh como root
CMD /run.sh
# Vulnerable: depuración duplicada
ENV APP_DEBUG=true
ENV ENV=production
CMD /run.sh...

✅ Secure code example

# Use ARG for build-time variables
ARG ENV_TYPE

# Set safer defaults for production use
ENV APP_DEBUG=false
ENV ENV=production

# Use non-root user for security...