Saint Smart Toilet, Who Left Debug Open

Patron of connected bathroom fixtures, DEBUG = True in production, and error pages that talk too much.

Life

On 9 January 2025 CVE-2024-56113 was published: version 1.3.11 of Motius's Smart Toilet Lab ran with Django's debug mode switched on. Triggering an error was enough for the friendly error page to list the project's settings, secrets included. A rare case where the flush worked perfectly, just in the wrong direction.

Prayer

O Saint Smart Toilet, who shows everyone what should stay closed, remind us to put the debug lid down before going to production. Amen.

How to celebrate

Celebrated by setting DEBUG = False, rotating the secrets already exposed, and flushing the development config away.