The less confusing (and harmful) defaults for code and configuration are different and opposite. Here it is:

By Default

1. Run production code.
2. Use development configuration.

Other should be specified implicitly.

Why?

Development code can skip some checks or allow users to override permissions. Production code is (well should be) free of such dangerous behavior. That's why production code should be run by default.

In the same time development configuration usually specifies test database and API endpoints. And thus such configuration couldn't spent users funds or send a real messages and considered less harmful.

How

Debug/Dev mode

❌ Wrong:

const DEBUG = process.env.NODE_ENV !== 'production'

✅ Correct:

const DEBUG = process.env.NODE_ENV === 'development'

Config

❌ Wrong:

const CFG = process.env.NODE_ENV || 'production'

const config = require(`configs/${CFG}.js`)

✅ Correct

const CFG = process.env.NODE_ENV || 'development'

const config = require(`configs/${CFG}.js`)