fix(security): disable debug by default, escape traceback XSS, gate OpenAPI docs

[namann5]

Summary

Fixes a Critical (CVSS ~8.1) vulnerability where debug mode defaults to enabled and the unhandled exception handler serves full Python tracebacks as raw, unescaped HTML — enabling Reflected XSS and full stack trace information disclosure in production.

Fixes: #2022

Changes

Root Cause

1. backend/secuscan/config.py:22 — debug: bool = True meant production deployments could accidentally run with debug enabled
2. backend/secuscan/main.py:283 — traceback.format_exc() was embedded directly into HTML with no escaping (<pre>{traceback.format_exc()}</pre>), allowing XSS if exception messages contain attacker-controlled content
3. /docs, /redoc, /openapi.json were publicly accessible, exposing the full API schema

Fix

#	File	Change
1	config.py:22	Changed debug: bool = True to debug: bool = False (secure-by-default)
2	main.py:293	Added html_mod.escape() around traceback.format_exc() to prevent XSS
3	main.py:171-173	Gated docs_url, redoc_url, openapi_url behind settings.debug
4	main.py:177-200	Gated redirect endpoints (/api/docs, /api/redoc, /api/openapi.json) behind debug mode

Security Impact

Before	After
debug=True by default	debug=False by default
Raw traceback in HTML (XSS)	HTML-escaped traceback
/docs always accessible	/docs only in debug mode
/openapi.json always accessible	/openapi.json only in debug mode

Configuration

# Production (default) — safe
# No configuration needed

# Development — enable debug features
SECUSCAN_DEBUG=true

Testing

• 29/29 config unit tests pass
• Updated test_settings_default_debug to assert False default
• Existing test_request_id_middleware already handles both debug modes
• No merge conflicts with main

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f94770a7fb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[utksh1]

The secure default is sensible, but this PR currently breaks the fresh-clone smoke check: start.sh starts the backend with debug disabled while CI polls /openapi.json, so the server is healthy but CI times out. Please update the development/startup path (or the health check) so it does not rely on a disabled documentation endpoint, and add focused tests for debug-on/debug-off docs and escaped traceback behavior.

[namann5]

@utksh1 Changes are done