The debugger statement can be placed anywhere in procedures to suspend execution. Using the debugger statement is similar to setting a breakpoint in the code. By definition such statement must absolutely be removed from the source code to prevent any unexpected behavior or added vulnerability to attacks in production.

## Noncompliant Code Example

    for (i = 1; i<5; i++) {
      // Print i to the Output window.
      Debug.write("loop index is " + i);
      // Wait for user to resume.
      debugger;
    }

## Compliant Solution

    for (i = 1; i<5; i++) {
      // Print i to the Output window.
      Debug.write("loop index is " + i);
    }

## See

- MITRE, CWE-489 - Leftover Debug Code