diff --git a/.Jules/sentinel.md b/.Jules/sentinel.md
new file mode 100644
index 0000000..349b314
--- /dev/null
+++ b/.Jules/sentinel.md
@@ -0,0 +1,5 @@
+
+## 2026-08-25 - Werkzeug Interactive Debugger Exposure
+**Vulnerability:** Flask development server was configured with `debug=True` while bound to a public interface (`0.0.0.0`), exposing the Werkzeug interactive debugger which allows unauthenticated Remote Code Execution (RCE).
+**Learning:** Development configurations should never be hardcoded and exposed on public interfaces, especially in network-facing scripts like `web_app/run.py`.
+**Prevention:** Explicitly set `debug=False` in production application entry points, or use environment variables to control debug mode instead of hardcoding `True`.
diff --git a/web_app/app.py b/web_app/app.py
index 8cd5aa5..2f95e5f 100644
--- a/web_app/app.py
+++ b/web_app/app.py
@@ -219,4 +219,6 @@ def download(job_id):
 if __name__ == '__main__':
     os.makedirs(app.config['UPLOAD_FOLDER'], exist_ok=True)
     os.makedirs(app.config['OUTPUT_FOLDER'], exist_ok=True)
-    app.run(debug=True, host='0.0.0.0', port=5000, threaded=True, use_reloader=False)
+    # 🛡️ Sentinel: Disable debug mode on public interfaces (0.0.0.0)
+    # to prevent Werkzeug interactive debugger RCE vulnerability.
+    app.run(debug=False, host='0.0.0.0', port=5000, threaded=True, use_reloader=False)
diff --git a/web_app/run.py b/web_app/run.py
index 6d017f1..7f391f9 100644
--- a/web_app/run.py
+++ b/web_app/run.py
@@ -22,4 +22,6 @@
     print("Press CTRL+C to stop")
     print("=" * 60)
     
-    app.run(debug=True, host='0.0.0.0', port=5000, threaded=True, use_reloader=False)
+    # 🛡️ Sentinel: Disable debug mode on public interfaces (0.0.0.0)
+    # to prevent Werkzeug interactive debugger RCE vulnerability.
+    app.run(debug=False, host='0.0.0.0', port=5000, threaded=True, use_reloader=False)