Restrict a debug endpoint to admins

auth-debug-endpoint

A debug endpoint was reachable during the scan. If it prints internal state, restrict it to the intended accounts, or drop it from production builds.

location ~ ^/(debug|_debug|__debug) {
    deny all;
    return 404;
}

if (process.env.NODE_ENV !== 'production') {
  app.get('/debug', debugHandler);
}