Debug Mode Check: What StackShield Detects in Production
Checks if Laravel debug mode is enabled in production.
What This Check Detects
Checks if Laravel debug mode is enabled in production.
Full Documentation
What this check looks for
StackShield triggers error conditions and inspects how your application responds. It is looking for the signature of APP_DEBUG=true in production: a rich Laravel error page, an Ignition stack trace, or environment values rendered into the response instead of a plain error page.
Debug mode is invisible until something goes wrong, which is precisely when an attacker will make something go wrong on purpose.
Why it matters
When debug mode is on, a Laravel error page does not just say something failed. It renders a stack trace with environment context, and that routinely includes the APP_KEY, database credentials and third-party tokens. An attacker does not need to find a vulnerability; they need to cause an error, and errors are easy to cause.
The APP_KEY in particular is not merely a secret. Laravel uses it to sign and encrypt trusted data, so a leaked key opens the door to forged payloads. Debug pages are also indexed by search engines and actively searched for.
What a failed check means
A failed check means your production application exposed debug output when StackShield triggered an error. It is one of the highest-severity findings there is, because the distance from misconfiguration to full compromise is a single error away.
The fix is APP_DEBUG=false and APP_ENV=production, cleared from any cached config, then confirmed from outside.
See the step-by-step remediation: how to fix this.
Related Security Checks
Exposed .env Files
Checks if .env files are publicly accessible.
Laravel Ignition Exposure
Checks if Laravel Ignition error page is exposed in production.
Laravel Telescope Exposure
Checks if Laravel Telescope debugging tool is exposed in production.
Is your Laravel app exposed right now?
34% of Laravel apps we scan have at least one critical issue, and most teams do not find out until something breaks. The free scan checks your live app in 60 seconds. Then StackShield re-runs every check after each deploy, so a fix you ship today does not quietly regress next week.