[security] M-7: DEBUG=True hardcoded

[jacobyoby]

Severity: Medium
Files: parse.py:129, testrun.py:4

Problem

DEBUG=True is hardcoded, exposing debug information and stack traces in production.

Remediation

Read DEBUG from configuration. Default to False in production.

Source

Finding from security audit (2026-08-31). See .github/SECURITY_AUDIT_TRIAGE.md.