rules:
- id: debug-enabled
  patterns:
  - pattern-inside: |
      import flask
      ...
  - pattern: $APP.run(..., debug=True, ...)
  message: >-
    Detected Flask app with debug=True. Do not deploy to production with this flag enabled
    as it will leak sensitive information. Instead, consider using Flask configuration
    variables or setting 'debug' using system environment variables.
  metadata:
    cwe:
    - 'CWE-489: Active Debug Code'
    owasp: 'A06:2017 - Security Misconfiguration'
    references:
    - https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/
    category: security
    technology:
    - flask
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
  severity: WARNING
  languages:
  - python