Your password was exposed in a data breach

Security controls are typically relaxed in development and progressively hardened in staging and production. Browser Password Breach Alert appearing only in production reflects a security control that is not present in development environments. Common development-to-production security gaps: HTTPS is not enforced locally, so TLS errors only appear in production. Content Security Policy headers are absent in the webpack dev server. CORS allows all origins (*) in development but specifies origins in production. Same-site cookie attributes are not set in development, causing authentication failures in production with strict same-site enforcement. Rate limiting does not apply in development but blocks automated tests or power users in production. The systematic approach: use environment parity — configure the same security headers in development as in production, just pointing to local resources. Tools like helmet (Node.js) apply production-appropriate security headers with sensible defaults. Test security headers with SecurityHeaders.com and Mozilla Observatory. Run HTTPS locally using mkcert to eliminate the HTTPS gap between development and production that causes most environment-specific Browser Password Breach Alert.