Hi Everyone! We want to figure out how to disable dev tools growthbook extension/plugin so that in prod users can't see features we have + turn on/off. We set the following

window.growthbook_config.enableDevMode = false;
    window.growthbook_config.disableDevTools = true;

Just before our script

<script async
    data-client-key="<%= process.env.GROWTHBOOK_CLIENT_KEY %>"
    src="<https://cdn.jsdelivr.net/npm/@growthbook/growthbook/dist/bundles/auto.min.js>"
  ></script>

but it doesn't seem to do anything, still can access the dev tools extension, view & change values. Any ideas what we do wrong ? Thank you for help! 🙂

Were you able to debug this? The command should be

enableDevMode = false

. You should be able to also console log

_growthbook

and see what that value is set to.

Yes, can still see this, so looks like it was not set, event though we set it in script before loading growthbook via cdn

do you have the URL where this is happening?

Yes, you can see it here https://qa4-group-ca.owlpractice-dev.ca/login no need to log in

Ok. Dug into the dev tools code. It looks like Dev Tools is forcing the enableDevTools to true, no matter which attribute you use. So, dev mode will be off by default, unless Dev Tools is installed. I'm checking with the team on whether that's the intended behavior or not. I'll follow up.

Thank you so much for help, let us know please :)

No update, except to say that the dev tools does force this value to true, when installed. This is to guarantee that it works as expected. Let me know if you have additional questions.

So in any case the value for enableDevMode is true ? How is this expected 😄 Unless I misunderstand ?

Yes. There are instances where this is necessary to make dev tools work (when the SDK is injected), which is why it turns the value to true. We'll take a look at refactoring this, tho.

Got it, thank you so much! Would appreciate it very much if you can let me know once it's ready, so we can make changes for it to work if needed 🙂

What's the concern on your side, just so I understand fully?

Well it sounds bad that any person can see and manipulate feature flagging on the site that we have. We don't want to expose feature flags, experiments, client keys to the production site

I hear you on that. One thing to be aware of is that users can inspect the payload for flags, which will include this info, too. Of course, it's much harder to manipulate but also doesn't require you to download the extension. One of the solutions we offer here is to use secure attributes.

Hmm, got it, will check, but will it hide features we have & ability to turn the flag on/off ?

No. It obscures the values. I was saying that regardless of the dev tools, users could inspect network traffic and see this:

{
  "status": 200,
  "features": {
    "OPS-5723-contact-support-open-in-new-tab": {
      "defaultValue": false,
      "rules": [
        {
          "force": false
        }
      ]
    },
    "ops-2004-new-psyquel-claims-modal": {
      "defaultValue": true,
      "rules": [
        {
          "condition": {
            "subdomain": "qa-group-us"
          },
          "force": true
        },
        {
          "condition": {
            "subdomain": "owltest-ananthanpsyquel"
          },
          "force": true
        },
        {
          "condition": {
            "subdomain": "montcotherapy"
          },
          "force": true
        },
        {
          "condition": {
            "subdomain": "owltest-qa1-wizardus"
          },
          "force": true
        },
        {
          "condition": {
            "subdomain": "testinsurancepractice"
          },
          "force": true
        },
        {
          "condition": {
            "subdomain": "wiseowltherapy"
          },
          "force": true
        }
      ]
    },
    "ops-1636-group-sessions": {
      "defaultValue": false,
      "rules": [
        {
          "force": false
        }
      ]
    },
    "ops-3350-instant-payout": {
      "defaultValue": true,
      "rules": [
        {
          "force": true
        }
      ]
    },
    "ops-3208-claims-comments": {
      "defaultValue": true,
      "rules": [
        {
          "force": true
        }
      ]
    },
    "ops-5241-ai-note-taking": {
      "defaultValue": false
    },
    "ops-9999-test": {
      "defaultValue": true
    },
    "ops-4701-show-forms-in-client-portal": {
      "defaultValue": true,
      "rules": [
        {
          "force": true
        }
      ]
    }
  },
  "dateUpdated": "2025-09-26T15:27:37.921Z"
}

Secure attributes would obscure these values.

I see, got it, but it won't stop them from turning the flag on/off ?

No. Just making you aware.