diff --git a/config/instance-config.js b/config/instance-config.js
index d937a9df..8f7313d9 100644
--- a/config/instance-config.js
+++ b/config/instance-config.js
@@ -33,6 +33,8 @@ export const IS_DEV_MODE = false;
  * a quieter dev mode without disabling other development helpers entirely.
  * Use the runtime override documented in `js/config.js` if you need to toggle
  * verbosity without editing this file.
+ *
+ * Security: This must be false in production.
  */
 export const IS_VERBOSE_DEV_MODE = false;
 
diff --git a/tests/unit/security-config.test.mjs b/tests/unit/security-config.test.mjs
new file mode 100644
index 00000000..04af2e14
--- /dev/null
+++ b/tests/unit/security-config.test.mjs
@@ -0,0 +1,11 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { IS_DEV_MODE, IS_VERBOSE_DEV_MODE } from '../../config/instance-config.js';
+
+test('Security configuration: IS_VERBOSE_DEV_MODE must be false', () => {
+  assert.strictEqual(IS_VERBOSE_DEV_MODE, false, 'IS_VERBOSE_DEV_MODE should be false in production');
+});
+
+test('Security configuration: IS_DEV_MODE must be false', () => {
+  assert.strictEqual(IS_DEV_MODE, false, 'IS_DEV_MODE should be false in production');
+});