Debug mode is useful while developing and dangerous in production. Debug pages, stack traces and detailed error messages show attackers your code paths, library versions, file locations and sometimes credentials.

How it happens

A framework's debug flag is left on after deployment, or an unhandled exception shows the full stack trace. Some debug consoles even allow running code directly on the server.

Why it matters

• Disclosure of source code, configuration and secrets.
• Remote code execution through interactive debug consoles.
• Easier exploitation of every other bug.

How to prevent it

• Make sure debug mode is off in production configuration, and check it in your deployment pipeline.
• Handle exceptions globally and return generic error pages.
• Log detailed errors on the server, not in the response.
• Remove test and diagnostic pages such as phpinfo.php.

How Vooki Pro helps

• Detects debug mode, verbose errors, stack traces and improper exception handling.
• Finds exposed phpinfo pages and error messages that reveal file paths or database details.
• Includes this in the standard and compliance reports you can share with your team.
• Schedule recurring scans to catch debug settings that return after a deployment.

Frequently asked questions

What is the risk of showing stack traces?

Stack traces reveal file paths, library versions and code structure, which helps attackers target other weaknesses.

How do I make sure debug mode stays off?

Set it in production configuration, verify it in your deployment pipeline, and scan the live site regularly.

Related: Securing OAuth, OpenID Connect and SAML single sign-on · Locking down admin panels and management endpoints