Is debug mode a vulnerability?

On a public origin, yes — it is an information-leak class. Turn it off and keep generic client errors.

Does Cloudflare hide debug pages?

No. It proxies whatever your origin returns unless you replace the error page yourself.

Does RoastMyOpsec set DEBUG?

No. It does not flip flags or send exploit payloads. It may read public error bodies heuristically.

Vulnerabilities

Framework Debug Mode vs Verbose API Errors

December 9, 2023

Framework debug mode vs verbose API errors is a global switch versus one noisy response. APP_DEBUG=true, Django DEBUG=True, Rails consider_all_requests_local, and similar flags turn 500s into inventory: paths, config keys, sometimes query shapes. A single verbose JSON error without the flag is still a leak, but smaller. phpinfo() is a cousin page dump. Production belongs on generic client messages and server-side logs. RoastMyOpsec may heuristic-scan common API error bodies. It does not set DEBUG, does not POST to trigger exceptions, and does not fetch phpinfo.php as a scored path.

The practical difference

Debug mode is environment-wide. One forgotten .env on the origin or a CDN that still points at a staging container keeps the yellow page on the brand hostname. Verbose errors can remain after DEBUG is false if a middleware still serializes stack traces. Fix both.

Behind Cloudflare is not off. The edge does not rewrite your framework flag.

How to choose production settings

CI: fail the build if DEBUG/APP_DEBUG is true in the production artifact. Runtime: generic 4xx/5xx HTML or JSON. Logs: stack traces only on the server. Staging: debug behind auth, not on the marketing host. See verbose API errors and phpinfo guides for the leftover pages.

Surface	Typical leak	First response	Takeaway
DEBUG / APP_DEBUG true	Every error becomes a dump	Set false; redeploy	Global switch
Chatty JSON 500, debug off	One endpoint's internals	Generic body; log server-side	See verbose API errors
/phpinfo.php	Runtime brochure	Delete; deny the name	See phpinfo vs verbose errors
X-Powered-By	Version hint	Strip at the edge	Fingerprint, not debug mode

What the roast can prove

Heuristic error-body hits can surface. The scan cannot prove DEBUG is false on every route. Confirm the env on the host you submitted. Pair with exposed .env if the flag leaked from a public file.

Common mistakes

The first mistake is APP_DEBUG=true 'only for this hotfix.'

The second mistake is DEBUG=False in settings.py and True in the container env that wins.

The third mistake is treating a roast miss on error heuristics as proof debug is off.

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Is debug mode a vulnerability?: On a public origin, yes — it is an information-leak class. Turn it off and keep generic client errors.
Does Cloudflare hide debug pages?: No. It proxies whatever your origin returns unless you replace the error page yourself.
Does RoastMyOpsec set DEBUG?: No. It does not flip flags or send exploit payloads. It may read public error bodies heuristically.

Sources

Related guides

Vulnerabilities
Verbose API Errors vs Generic Client Messages
Vulnerabilities
phpinfo() vs Verbose API Errors on Production
Vulnerabilities
WordPress debug.log vs Framework Debug on Production