diff --git a/.Jules/sentinel.md b/.Jules/sentinel.md
new file mode 100644
index 0000000..b614791
--- /dev/null
+++ b/.Jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2026-08-21 - Werkzeug Interactive Debugger Exposure
+**Vulnerability:** The Flask application was binding to public interfaces (`0.0.0.0`) while running with `debug=True` in `web_app/app.py` and `web_app/run.py`.
+**Learning:** Exposing the Werkzeug interactive debugger on public interfaces is a critical security vulnerability, as it allows arbitrary remote code execution on the server.
+**Prevention:** Always ensure development configurations (e.g., `debug=True`) are disabled or appropriately secured before allowing connections from all IP addresses (`0.0.0.0`), especially in environments that mimic or might be used as production.
diff --git a/web_app/app.py b/web_app/app.py
index 8cd5aa5..688cc39 100644
--- a/web_app/app.py
+++ b/web_app/app.py
@@ -219,4 +219,4 @@ def download(job_id):
 if __name__ == '__main__':
     os.makedirs(app.config['UPLOAD_FOLDER'], exist_ok=True)
     os.makedirs(app.config['OUTPUT_FOLDER'], exist_ok=True)
-    app.run(debug=True, host='0.0.0.0', port=5000, threaded=True, use_reloader=False)
+    app.run(debug=False, host='0.0.0.0', port=5000, threaded=True, use_reloader=False)
diff --git a/web_app/run.py b/web_app/run.py
index 6d017f1..6ddd4fd 100644
--- a/web_app/run.py
+++ b/web_app/run.py
@@ -22,4 +22,4 @@
     print("Press CTRL+C to stop")
     print("=" * 60)
     
-    app.run(debug=True, host='0.0.0.0', port=5000, threaded=True, use_reloader=False)
+    app.run(debug=False, host='0.0.0.0', port=5000, threaded=True, use_reloader=False)