sus.botdocs

Security finding

The live site runs a development build or a development server

Security Warning Severity: Medium

Part of the audit Information exposure. Finding id: security.devBuildInProduction.

What it costs you

A development build is larger and slower, and carries checks, warnings and internals meant for developers. A development server on the live site may serve the source code and accept connections it was never meant to.

What to do

Build the site in production mode and deploy the output of that build, not the development server.

What it checks

  • Test version of software running live

How to fix it

Deploy the production build

  1. Check how the live site is started. If it runs the framework's development server (vite, next dev, webpack serve or similar), replace it with the production build and a production server.
  2. If the page loads a development file from a CDN, change it to the production file of the same version (for React the .production.min.js files, for Vue 3 vue.global.prod.js).
  3. Make sure the build runs in production mode, which usually means the environment variable NODE_ENV is production during the build.

How to check: Reload [example url] with the browser console open: no development-mode message, and no development file in the network list.