Development leftovers in production
Individually harmless, collectively a signal.
What they tell someone
That the deployed build is not a production build. That means more verbose error messages, a larger download, internal file paths in stack traces, and framework development warnings that describe your component structure.
None of it is an attack. All of it makes the next step easier, and a production build removes it for free.
The specific ones to remove
Debug flags left true. Test and story files bundled with the app. Localhost or ngrok URLs. TODO comments about security you had meant to come back to. A development build deployed as production.
Check what your build actually copies into the output directory, not just what your repository ignores.
Not sure whether this applies to you?
Give us the address and we will tell you. No code, no access, no install — and every finding we have is shown in full, including on the free trial.
Check a site