Static security scanner false positive: config/debug-enabled matches legitimate CLI flags

[ajianaz]

Problem

The config/debug-enabled security pattern matches legitimate debug flags in development tooling, shell scripts, and configuration files.

Current Regex

regex: r"(?i)(?:DEBUG\s*=\s*True|debug:\s*true|--debug)",

The --debug alternative is too broad — it matches any occurrence of --debug in any context, including:

• CLI argument documentation
• Shell scripts that pass --debug to subcommands
• Development configuration files
• Build scripts and Makefiles

False Positive Examples

Input	Why it matches	Why it should not
RUST_LOG=debug cargo run -- --debug	--debug	Dev tooling, not production code
RUN cargo build -- --debug 2>/dev/null	--debug	Dockerfile build step
# Use --debug for verbose output	--debug	Documentation comment
args = parser.add_argument("--debug")	--debug	Argument parser definition

Root Cause

Same architectural pattern as #483 and #485 — keyword-based matching without code context awareness.

Suggested Fix

1. Remove bare --debug from regex — it matches too many legitimate contexts
2. Keep DEBUG = True and debug: true — these are config assignments that are more likely real findings
3. Add post-match filter for comment/argument-parser contexts
4. Consider scoping to config files only (.env, config.py, config.yml, settings.json)

Reproduction

echo "RUN cargo test -- --debug" > Dockerfile
cora review --format sarif  # Reports config/debug-enabled on Dockerfile

Related

• Static security scanner reports stale/false-positive CORS finding after source text changed #483 — CORS wildcard false positive (same pattern, fixed in fix(scanner): narrow CORS wildcard regex + skip doc files + negation filter #484)
• Static security scanner false positive: injection/sql-concat matches comments and non-SQL concatenation #485 — injection/sql-concat false positive (same pattern, pending fix)