Medium severityGoInsecure ConfigurationMEDIUM confidence

Gin Debug Mode

Gin is running in debug mode (or gin.Default(), which does not force release mode) (CWE-489/CWE-1188).

Standards mapping

CWE: CWE-489: Active Debug Code CWE-1188: Initialization of a Resource with an Insecure Default
OWASP Top 10: A05:2021 - Security Misconfiguration
OWASP ASVS: V14.3.2 (L1)

Vulnerable vs. safe

Flagged by this check

gin.SetMode(gin.DebugMode)

Passes - the safe pattern

gin.SetMode(gin.ReleaseMode)

Why it matters & how to fix it

Gin is running in debug mode (or gin.Default(), which does not force release mode) (CWE-489/CWE-1188). Debug mode prints verbose request logs and internal warnings that can leak routing and configuration details in production. Call gin.SetMode(gin.ReleaseMode) at startup (or set GIN_MODE=release) before creating the engine.

References

Rule ID integsec-go-gin-debug-mode - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks