High severityPHPInsecure ConfigurationMEDIUM confidence

Laravel App Debug True

Laravel debug mode is hardcoded on ('debug' => true) (CWE-489).

Standards mapping

CWE: CWE-489: Active Debug Code
OWASP Top 10: A05:2021 - Security Misconfiguration
OWASP ASVS: V14.3.2 (L1)

Vulnerable vs. safe

Flagged by this check

return ['name' => 'App', 'debug' => true];

Passes - the safe pattern

return ['name' => 'App', 'debug' => env('APP_DEBUG', false)];

Why it matters & how to fix it

Laravel debug mode is hardcoded on ('debug' => true) (CWE-489). The Ignition/Whoops error page leaks environment variables, source, and stack traces to anyone who triggers an error. Use 'debug' => env('APP_DEBUG', false) and keep APP_DEBUG=false in production.

References

Rule ID integsec-php-laravel-app-debug-true - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks