Debug & Error Information Disclosure
Stack traces, SQL errors and framework debug pages leak server file paths, database structure and library versions straight into the response.
Results in 1–3 minutes · Free · No signup required
Why It Matters
Debug output is reconnaissance handed to the attacker for free: a SQL error confirms an injection point and names your tables, a stack trace maps your directory layout and framework version, and a debug toolbar can expose environment variables and database credentials outright.
How We Check
We scan the response for PHP fatal errors, warnings and stack traces with server paths, MySQL/PostgreSQL error strings and raw SQL, ORM exceptions, and framework debug pages left enabled in production.
How to Fix
Turn debug mode off in production (display_errors=Off, APP_DEBUG=false, DEBUG=False) and log errors to a file or an observability backend instead of the response body. Return generic error pages for 4xx/5xx, and make sure the generic handler covers unhandled exceptions too.
Frequently Asked Questions
What is Debug & Error Information Disclosure?
Stack traces, SQL errors and framework debug pages leak server file paths, database structure and library versions straight into the response.
Why does Debug & Error Information Disclosure matter for website security?
Debug output is reconnaissance handed to the attacker for free: a SQL error confirms an injection point and names your tables, a stack trace maps your directory layout and framework version, and a debug toolbar can expose environment variables and database credentials outright.
How do I fix Debug & Error Information Disclosure issues?
Turn debug mode off in production (display_errors=Off, APP_DEBUG=false, DEBUG=False) and log errors to a file or an observability backend instead of the response body. Return generic error pages for 4xx/5xx, and make sure the generic handler covers unhandled exceptions too.
Related Security Checks
Check Your Website Now
Run a free security scan to check for Debug & Error Information Disclosure issues and 62+ other security vulnerabilities.
Scan Your Website Free