Debug Features Enabled in Production

# application.properties (Production)
# DANGEROUS: Shows full stack trace in browser/API response.
server.error.include-stacktrace=always
# DANGEROUS: Running with development profile active in prod.
# spring.profiles.active=development

# application.properties / logback.xml / log4j2.xml (Production)
# DANGEROUS: Logging excessive DEBUG or TRACE level info in production
# might leak sensitive operational data or performance details.
logging.level.org.springframework=DEBUG
logging.level.com.myapp=TRACE

# application-production.properties (Secure)
# SECURE: Activate this profile via env var SPRING_PROFILES_ACTIVE=production

# SECURE: Never include stack traces in responses.
server.error.include-stacktrace=never
# SECURE: Disable the default Spring error page.
server.error.whitelabel.enabled=false

# SECURE: Set appropriate logging levels for production.
logging.level.root=INFO
logging.level.org.springframework=WARN
logging.level.com.myapp=INFO # Adjust as needed

# DANGEROUS: Environment variable set incorrectly on production server
export ASPNETCORE_ENVIRONMENT=Development
# or SET ASPNETCORE_ENVIRONMENT=Development (Windows)
# or configured in launchSettings.json / web.config / IIS settings

<configuration>
  <system.web>
    <compilation debug="true" targetFramework="4.8" />
    </system.web>
</configuration>

// Startup.cs - Configure() (ASP.NET Core - Secure)
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // SECURE: Only use developer page in Development environment.
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    else
    {
        app.UseExceptionHandler("/Home/Error"); // Generic error handler
        app.UseHsts();
    }
    // ... rest of configuration ...
}
// Ensure ASPNETCORE_ENVIRONMENT=Production is set via server env var,
// web.config, Azure App Service settings, etc.

<configuration>
  <system.web>
    <compilation debug="false" targetFramework="4.8" />
    <customErrors mode="On" defaultRedirect="~/ErrorPages/GenericError.html">
         <error statusCode="404" redirect="~/ErrorPages/NotFound.html" />
    </customErrors>
    </system.web>
</configuration>

# .env (Production)
APP_ENV=production
# DANGEROUS: Shows detailed Ignition/Whoops error pages.
APP_DEBUG=true

; php.ini (Production Server)
; DANGEROUS: Renders PHP errors directly in the output.
display_errors = On
error_reporting = E_ALL

# .env (Laravel Production - Secure)
APP_ENV=production
APP_DEBUG=false # SECURE
LOG_CHANNEL=stack # Or other production logger

; php.ini (Production - Secure)
display_errors = Off    ; SECURE
log_errors = On       ; SECURE (Log errors)
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
error_log = /var/log/php_errors.log

// app.js (Error Handler Middleware)
app.use((err, req, res, next) => {
    const statusCode = err.status || 500;
    console.error(err.stack); // Log for devs (good)

    // DANGEROUS: Sends stack trace regardless of environment.
    res.status(statusCode).json({
        message: err.message,
        // Attacker triggers error in production, gets stack trace.
        stack: err.stack // Should be conditional
    });
});

// app.js (Secure Error Handler)
const isProd = (process.env.NODE_ENV === 'production');

// ... other middleware and routes ...

// SECURE: Error handling middleware (place last)
app.use((err, req, res, next) => {
    const statusCode = err.status || 500;

    // SECURE: Log the full error server-side
    console.error(`[${new Date().toISOString()}] ${statusCode} ${req.method} ${req.url} Error: ${err.message}`);
    console.error(err.stack); // Log stack trace

    res.status(statusCode);

    // SECURE: Send generic response in production
    if (isProd) {
        res.json({ message: "An internal server error occurred." });
    } else {
        // Development: Send more details
        res.json({ message: err.message, stack: err.stack });
    }
});

// Ensure NODE_ENV=production is set via environment variable on the server

# config/environments/production.rb
Rails.application.configure do
  # DANGEROUS: Shows detailed debug exception pages.
  config.consider_all_requests_local = true
end

# config/environments/production.rb
Rails.application.configure do
  # DANGEROUS: Excessive logging can leak operational details
  # and impact performance.
  config.log_level = :debug
end

# config/environments/production.rb (Secure)
Rails.application.configure do
  # SECURE: Ensures generic public error pages are shown.
  config.consider_all_requests_local = false

  # SECURE: Set appropriate log level for production.
  config.log_level = :info

  # Configure log formatter if needed to avoid leaking sensitive data
  # config.log_formatter = MySecureFormatter.new

  # Use default static error pages or configure exceptions_app
  # config.exceptions_app = self.routes
end