diff --git a/backend/app/main.py b/backend/app/main.py
index de184a15..d601ca4b 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -89,12 +89,13 @@ async def health_check():
     return {"status": "healthy"}
 
 
-@app.get("/debug/cors")
-async def debug_cors():
-    """Debug endpoint to check CORS configuration."""
-    return {
-        "allow_railway_origins": settings.ALLOW_RAILWAY_ORIGINS,
-        "cors_mode": "regex + list" if settings.ALLOW_RAILWAY_ORIGINS else "list",
-        "allowed_origins": settings.allowed_origins,
-        "railway_regex": r"https://.*\.up\.railway\.app" if settings.ALLOW_RAILWAY_ORIGINS else None
-    }
+if settings.DEBUG:
+    @app.get("/debug/cors")
+    async def debug_cors():
+        """Debug endpoint to check CORS configuration."""
+        return {
+            "allow_railway_origins": settings.ALLOW_RAILWAY_ORIGINS,
+            "cors_mode": "regex + list" if settings.ALLOW_RAILWAY_ORIGINS else "list",
+            "allowed_origins": settings.allowed_origins,
+            "railway_regex": r"https://.*\.up\.railway\.app" if settings.ALLOW_RAILWAY_ORIGINS else None
+        }