Feature flags are switches in application code or a configuration service that let teams deploy software separately from exposing it to users. A flag can keep a new function hidden, enable it for a small group, or turn it on only in production for specific accounts, regions, or roles.
In cyber security, feature flags matter because they reduce release risk and shrink the blast radius of mistakes. Teams can ship code behind a disabled flag, test it safely, and roll it back instantly by flipping a control instead of redeploying. They also support gradual rollouts and A/B testing, which helps detect regressions in authentication, access control, logging, or multi-tenant isolation before full exposure. The security risk is that flags themselves become privileged controls: if attackers can change them, they may unlock unfinished features, bypass checks, or expose sensitive paths. Good practice is to protect flag management with strong access control, audit logs, and removal of stale flags.