Debug & Error Information Disclosure
Stack traces, SQL errors and framework debug pages leak server file paths, database structure and library versions straight into the response.
Why It Matters
Debug output is reconnaissance handed to the attacker for free: a SQL error confirms an injection point and names your tables, a stack trace maps your directory layout and framework version, and a debug toolbar can expose environment variables and database credentials outright.
How We Check
We scan the response for PHP fatal errors, warnings and stack traces with server paths, MySQL/PostgreSQL error strings and raw SQL, ORM exceptions, and framework debug pages left enabled in production.
How to Fix
Turn debug mode off in production (display_errors=Off, APP_DEBUG=false, DEBUG=False) and log errors to a file or an observability backend instead of the response body. Return generic error pages for 4xx/5xx, and make sure the generic handler covers unhandled exceptions too.
Frequently Asked Questions
What is Debug & Error Information Disclosure?
Stack traces, SQL errors and framework debug pages leak server file paths, database structure and library versions straight into the response.
Why does Debug & Error Information Disclosure matter for website security?
Debug output is reconnaissance handed to the attacker for free: a SQL error confirms an injection point and names your tables, a stack trace maps your directory layout and framework version, and a debug toolbar can expose environment variables and database credentials outright.
How do I fix Debug & Error Information Disclosure issues?
Turn debug mode off in production (display_errors=Off, APP_DEBUG=false, DEBUG=False) and log errors to a file or an observability backend instead of the response body. Return generic error pages for 4xx/5xx, and make sure the generic handler covers unhandled exceptions too.
Related Security Checks
Check Your Website Now
Run a free security scan to check for Debug & Error Information Disclosure issues and 62+ other security vulnerabilities.
Scan Your Website Free