Description

This detector identifies Ruby debugger calls left in non-test code that could expose sensitive application state in production environments. Debugger statements like 'byebug' can halt execution and provide interactive access to the application's runtime state, potentially allowing attackers to extract sensitive data or manipulate program flow.

Detection Strategy

• Ruby source files are scanned (excluding test files)

• Method calls and expressions are analyzed to identify bare 'byebug' debugger invocations

• Files with paths indicating they are test files are excluded from analysis

• Vulnerability is reported when debugger calls are found in production code that could be accidentally deployed

Vulnerable code example

class UsersController < ApplicationController
  def show
    @user = User.find(params[:id])
    byebug # Debugger call left in production code - security risk
    render json: @user
  end
end
...

✅ Secure code example

class UsersController < ApplicationController
  def show
    @user = User.find(params[:id])
    # Removed byebug - debugger calls expose sensitive data in production
    render json: @user
  end
end
...