SEC-028
Runtime debug endpoints are public
MediumDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Go /debug/pprof/ and /debug/vars.
Why it matters
Profiling endpoints reveal the program’s command line, memory and internals, and can be used to slow the server down.
Recommended fix
Serve debug handlers on a separate internal port, or remove them from production.
How to verify
Request each listed path on the live site and confirm it returns 404 or 403.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-028: Runtime debug endpoints are public
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Stop serving /debug/pprof and /debug/vars on the public listener: move them to an internal-only port or remove the import that registers them in production.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request each listed path on the live site and confirm it returns 404 or 403.