Extraneous functionality includes debug interfaces, test accounts, hidden admin panels, and development endpoints left in production builds. These features often have weaker security controls and provide attackers with unintended access paths. They are frequently discovered through reverse engineering.
Remove debug features, test endpoints, and hidden functionality from production builds. Use build configurations to exclude development-only code. Conduct thorough testing to identify and remove unintended functionality before release. Implement feature flags with proper access controls.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
Rank by release (taller is higher)
2024Latest
#10mobile10-2024 Insufficient Cryptography
No change since 20162016
#10Extraneous Functionality
