diff --git a/src/main/java/net/javahippie/fitpub/config/SecurityConfig.java b/src/main/java/net/javahippie/fitpub/config/SecurityConfig.java
index f2c442a..127a488 100644
--- a/src/main/java/net/javahippie/fitpub/config/SecurityConfig.java
+++ b/src/main/java/net/javahippie/fitpub/config/SecurityConfig.java
@@ -100,7 +100,7 @@ public class SecurityConfig {
                 .requestMatchers(HttpMethod.GET, "/api/activities/user/*").permitAll()
 
                 // Debug endpoints (dev only)
-                .requestMatchers("/api/debug/**").permitAll()
+                .requestMatchers("/api/debug/**").denyAll()
 
                 // Public endpoints - Likes and Comments (GET only)
                 .requestMatchers(HttpMethod.GET, "/api/activities/*/likes").permitAll()