fix: disable public Flask debug defaults by RYB-404 · Pull Request #5474 · Scottcjn/Rustchain

RYB-404 · 2026-05-16T18:48:35Z

Summary

Fixes [SECURITY] Public Flask entrypoints enable debug mode by default #4810 on current main; the earlier linked PR fix: disable public flask debug by default #4926 is closed/unmerged and the hardcoded debug defaults are still present.
Gates public Flask debug mode behind explicit per-service environment flags instead of defaulting to Werkzeug debug mode on 0.0.0.0.
Adds an AST regression test covering the public entrypoints from the issue so debug=True cannot be reintroduced for public binds.

Changed entrypoints

bridge/bridge_api.py -> BRIDGE_API_DEBUG
contributor_registry.py -> CONTRIBUTOR_REGISTRY_DEBUG
explorer/app.py -> RUSTCHAIN_EXPLORER_DEBUG
keeper_explorer.py -> KEEPER_EXPLORER_DEBUG
security_test_payment_widget.py -> SECURITY_TEST_WIDGET_DEBUG

Validation

python -m py_compile bridge/bridge_api.py contributor_registry.py explorer/app.py keeper_explorer.py security_test_payment_widget.py tests/test_public_flask_debug_defaults.py
direct AST regression test invocation -> passed
uv run --no-project --with pytest --with flask --with flask-cors --with requests python -m pytest tests/test_public_flask_debug_defaults.py -q -> 1 passed

Payout address can be provided if/when this is accepted for the RTC bounty.

github-actions · 2026-05-16T18:48:43Z

Welcome to RustChain! Thanks for your first pull request.

Before we review, please make sure:

Non-doc PRs have a BCOS-L1 or BCOS-L2 label
Doc-only PRs are exempt from BCOS tier labels when they only touch docs/**, *.md, or common image/PDF files
New code files include an SPDX license header
You've tested your changes against the live node

Bounty tiers: Micro (1-10 RTC) | Standard (20-50) | Major (75-100) | Critical (100-150)

A maintainer will review your PR soon. Thanks for contributing!

ZacharyZhang-NY

Reviewed PR #5474 at 92e7c9e.

Validation performed on Windows Python 3.12:

python -m py_compile bridge/bridge_api.py contributor_registry.py explorer/app.py keeper_explorer.py security_test_payment_widget.py tests/test_public_flask_debug_defaults.py passed. Existing keeper_explorer.py emitted the current invalid-escape SyntaxWarning, but compilation completed.
python -m pytest tests/test_public_flask_debug_defaults.py -q passed with 1 passed, 1 warning in 0.07s.
git diff --check origin/main...HEAD passed.
Static scan confirmed the affected public entrypoints now pass env-controlled debug values instead of literal debug=True on 0.0.0.0 binds.

The change matches #4810's intent: debug mode is off by default for public-facing helper services, while local development can opt in per service through explicit environment flags. I did not find a blocking issue.

HCIE2054

LGTM!

kekehanshujun

LGTM. I verified the public Flask entrypoints covered by #4810 no longer pass a literal debug=True for 0.0.0.0 binds, and the new AST regression test catches that pattern.

Validation run on the PR diff:

python -m py_compile bridge/bridge_api.py contributor_registry.py explorer/app.py keeper_explorer.py security_test_payment_widget.py tests/test_public_flask_debug_defaults.py
python -m pytest tests/test_public_flask_debug_defaults.py -q --tb=short -> 1 passed, with the existing keeper_explorer.py invalid-escape warning
git diff --check -- bridge/bridge_api.py contributor_registry.py explorer/app.py keeper_explorer.py security_test_payment_widget.py tests/test_public_flask_debug_defaults.py

No blocking issues found.

jaxint

LGTM! Thanks for contributing. Approved.

HCIE2054

LGTM!

HCIE2054

LGTM!

HCIE2054

LGTM!

TJCurnutte

Approved. I focused on the public Flask entrypoint debug defaults and the regression test that prevents reintroducing debug=True on 0.0.0.0 servers.

Validation I ran against head 92e7c9ed94e3ad9b4b9e41e05715f3f0a07da760:

git diff --check origin/main...HEAD -- bridge/bridge_api.py contributor_registry.py explorer/app.py keeper_explorer.py security_test_payment_widget.py tests/test_public_flask_debug_defaults.py
python3 -B -m py_compile bridge/bridge_api.py contributor_registry.py explorer/app.py keeper_explorer.py security_test_payment_widget.py tests/test_public_flask_debug_defaults.py
uv run --no-project --with pytest python -B -m pytest -q tests/test_public_flask_debug_defaults.py --noconftest

The focused pytest passed with 1 passed, 1 warning in 0.04s (keeper_explorer.py already has an invalid-escape deprecation warning unrelated to this change).

I also ran an AST probe over the modified entrypoints and confirmed the app.run(..., debug=...) arguments now route through opt-in helpers instead of a literal True: bridge/bridge_api.py uses _debug_enabled(), and contributor_registry.py, explorer/app.py, keeper_explorer.py, and security_test_payment_widget.py use debug_enabled().

That preserves a deliberate local-debug escape hatch through environment variables while making the public/default launch path fail closed.

HCIE2054

LGTM!

ZacharyZhang-NY

Reviewed PR #5474 at head 92e7c9e.

Validation performed:

Checked issue #4810. The scoped security bug is public Flask entrypoints binding to 0.0.0.0 while hard-coding debug=True by default.
git fetch origin pull/5474/head:review-pr-5474 --force
git diff --check origin/main...review-pr-5474 -- bridge/bridge_api.py contributor_registry.py explorer/app.py keeper_explorer.py security_test_payment_widget.py tests/test_public_flask_debug_defaults.py -> passed.
python -m py_compile bridge/bridge_api.py contributor_registry.py explorer/app.py keeper_explorer.py security_test_payment_widget.py tests/test_public_flask_debug_defaults.py on an extracted PR-head tree -> passed.
python -m pytest tests/test_public_flask_debug_defaults.py -q --confcutdir= -> 1 passed.
Probed the five new debug helpers with lightweight dependency stubs: BRIDGE_API_DEBUG, CONTRIBUTOR_REGISTRY_DEBUG, RUSTCHAIN_EXPLORER_DEBUG, KEEPER_EXPLORER_DEBUG, and SECURITY_TEST_WIDGET_DEBUG all default to False and return True for true.

The public Flask entrypoints now require explicit per-service env opt-in for debug mode, and the AST regression covers the listed public binds. Approving.

BossChaos · 2026-05-17T03:28:22Z

Code Review — Bounty #73

PR: fix: disable public Flask debug defaults by @RYB-404
Files changed: 6 (+76/-5)

✅ Bug fix or input validation

Summary

This is a bug fix PR. Changes appear consistent with project patterns.

Wallet: 0xdaE5d307339074A24F579dB48e7c639359D94904

Reviewing under Bounty #73 — Code Review Bounty Program

HCIE2054

LGTM!

HCIE2054

LGTM!

HCIE2054

LGTM!

508704820

Disable public Flask debug defaults. CRITICAL - public debug defaults expose interactive debugger and source code. This is the second Flask debug fix (also #5531). Verify ALL Flask app instances have debug disabled, not just the main one. Consider adding a CI assertion. - Xeophon (security review)

508704820

Flask debug defaults fix. SECURITY: Critical hardening — debug=True on 0.0.0.0 exposes Werkzeug debugger, allows arbitrary code execution. The AST regression test is excellent prevention. Reviewed by: Xeophon (security specialist). Recommendation: MERGE — this is a real attack vector.

HCIE2054

LGTM!

HCIE2054

LGTM!

508704820 · 2026-05-17T11:30:54Z

Security Review ✅

Flask debug mode gated behind explicit per-service env flags instead of defaulting to Werkzeug debug on 0.0.0.0. AST regression test ensures no hardcoded debug defaults. Same class as #5531 and #5488 but covers remaining services.

Reviewed by Xeophon - Solana: Lt9nERv6VHsojw15LpFeiaabuphAggzfLF9sM9UXRrZ

HCIE2054

LGTM!

HCIE2054

LGTM!

HCIE2054

LGTM!

jaxint

LGTM! Great work on this PR. 🚀

…g-4810 # Conflicts: # bridge/bridge_api.py # explorer/app.py

guangningsun · 2026-05-18T15:35:38Z

PR Review — PR #5474

Title: fix: disable public Flask debug defaults

Author: RYB-404

What I reviewed

bridge/bridge_api.py
contributor_registry.py
explorer/app.py

Observations

Similar to PR fix: disable public Flask debug entrypoints #5561 — adds debug mode environment variable checks instead of hardcoding debug=True.
Adds _debug_enabled() / debug_enabled() helper functions that check BRIDGE_API_DEBUG / CONTRIBUTOR_REGISTRY_DEBUG environment variables.
Changes: bridge_api.py +5/-1, contributor_registry.py +7/-1, explorer/app.py +8/-1.
This is a cleaner approach than PR fix: disable public Flask debug entrypoints #5561 — it allows debug mode to be enabled via environment variable when needed, without exposing debug on public servers.

LGTM pending CI. Better approach than PR #5561 — the environment variable pattern allows controlled debug access without hardcoded defaults.

Bounty: #2782
Disclosure: I received RTC compensation for this review.

RYB-404 · 2026-05-19T01:32:43Z

Hi @Scottcjn, thanks for merging this PR.

I noticed the award-rtc workflow failed after merge. Could you please check whether the RTC award needs a manual retry or manual payout?

PR: #5474

fix: disable public Flask debug defaults

92e7c9e

github-actions Bot added BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) BCOS-L2 Beacon Certified Open Source tier BCOS-L2 (required for non-doc PRs) security Security-related change tests Test suite changes size/M PR: 51-200 lines labels May 16, 2026

ZacharyZhang-NY approved these changes May 16, 2026

View reviewed changes

ZacharyZhang-NY mentioned this pull request May 16, 2026

[Bounty Claim] PR Review - RustChain PR #5474 (Bounty #73) Scottcjn/rustchain-bounties#10118

Open

HCIE2054 approved these changes May 16, 2026

View reviewed changes

kekehanshujun approved these changes May 16, 2026

View reviewed changes

kekehanshujun mentioned this pull request May 16, 2026

Bounty claim: code review for RustChain PR #5474 Scottcjn/rustchain-bounties#10125

Open

jaxint approved these changes May 16, 2026

View reviewed changes

HCIE2054 approved these changes May 16, 2026

View reviewed changes

TJCurnutte approved these changes May 16, 2026

View reviewed changes

TJCurnutte mentioned this pull request May 16, 2026

[BOUNTY] Code Review Bounty Program — Review PRs, Earn RTC (100 RTC Pool) Scottcjn/rustchain-bounties#73

Open

HCIE2054 approved these changes May 16, 2026

View reviewed changes

ZacharyZhang-NY approved these changes May 16, 2026

View reviewed changes

ZacharyZhang-NY mentioned this pull request May 16, 2026

[Bounty Claim] PR Review - RustChain PR #5474 (Bounty #305) Scottcjn/rustchain-bounties#10229

Open

HCIE2054 approved these changes May 17, 2026

View reviewed changes

508704820 reviewed May 17, 2026

View reviewed changes

508704820 mentioned this pull request May 17, 2026

Fix: Remove hardcoded debug=True in Flask entrypoints (#4810) #4859

Closed

508704820 reviewed May 17, 2026

View reviewed changes

HCIE2054 approved these changes May 17, 2026

View reviewed changes

HCIE2054 approved these changes May 18, 2026

View reviewed changes

jaxint approved these changes May 18, 2026

View reviewed changes

jaxint mentioned this pull request May 18, 2026

PR Review Claim - 18 PRs - 2026-05-18 15:06 UTC Scottcjn/rustchain-bounties#10903

Open

Merge remote-tracking branch 'origin/main' into fix/public-flask-debu…

d1863b2

…g-4810 # Conflicts: # bridge/bridge_api.py # explorer/app.py

guangningsun mentioned this pull request May 18, 2026

[ONBOARD: 2 RTC] Star + Review an Open PR Scottcjn/rustchain-bounties#2782

Open

Scottcjn merged commit a8c1a39 into Scottcjn:main May 18, 2026
10 of 11 checks passed

Scottcjn mentioned this pull request May 19, 2026

fix: keep RTC award workflow actionable when endpoint is down #5530

Merged

Uh oh!

Conversation

RYB-404 commented May 16, 2026

Summary

Changed entrypoints

Validation

Uh oh!

github-actions Bot commented May 16, 2026

Uh oh!

ZacharyZhang-NY left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

kekehanshujun left a comment

Choose a reason for hiding this comment

Uh oh!

jaxint left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

TJCurnutte left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

ZacharyZhang-NY left a comment

Choose a reason for hiding this comment

Uh oh!

BossChaos commented May 17, 2026

Code Review — Bounty #73

Summary

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

508704820 left a comment

Choose a reason for hiding this comment

Uh oh!

508704820 left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

508704820 commented May 17, 2026

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

jaxint left a comment

Choose a reason for hiding this comment

Uh oh!

guangningsun commented May 18, 2026

PR Review — PR #5474