DebugTagger
Flags debug, diagnostic, and internal-only endpoints — debug consoles
and toggles, profilers, Spring Boot Actuator, Go net/http/pprof,
heap/thread dumps, phpinfo, and /internal APIs. These should not be
publicly reachable: they leak environment, config, stack traces, and
heap contents, and some allow unsafe diagnostic actions (shutdown, GC,
logger changes). Surfacing them points a reviewer at a high-value,
frequently-misexposed surface.
Constants
internal / _internal is matched only as a standalone slash
segment (not the -/_ split used elsewhere), so /internal/jobs
is flagged but compound business names like /internal-transfer,
/internal-notes, or /internalized are not.
A debug toggle parameter (?debug=true, ?xdebug=...) flips an
endpoint into a debug/verbose mode regardless of its path.
__debugger__ is Werkzeug's interactive-console (RCE) marker.
The xdebug_session* / xdebug_profile triggers (sent as cookie,
GET, or POST param) switch Xdebug into remote-debug or profiling mode
— a well-known production exposure.
Unambiguous debug/diagnostic path segments — one is enough. Matched
as whole segments after splitting on /, -, _, ., so
/__debug__/ and /debug/pprof both yield a debug token,
phpinfo.php yields phpinfo, and /actuator/loggers is covered
both by actuator and root-path-exposed /loggers.
Weaker, more generic diagnostic segments. These also name ordinary product features (a "metrics" dashboard, a "console" UI), so tag only when two distinct weak tokens co-occur.