Rule Definition
ASP .NET applications can be configured to produce debug binaries. These binaries give detailed debugging messages and should not be used in production environments. Debug binaries are meant to be used in a development or testing environment and can pose a security risk if they are deployed to production. The file web.config contains the debug mode setting. Setting debug to "true" will let the browser display debugging information.

Remediation
Do not set debug information to true

Violation Code Sample

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.web>
<compilation
defaultLanguage="c#"
debug="true" //Violation
/>
...
</system.web>
</configuration>

Fixed Code Sample

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.web>
<compilation
defaultLanguage="c#"
debug="false" //No violation
/>
...
</system.web>
</configuration>

https://cwe.mitre.org/data/definitions/11.html