It's 11 PM 12 here in Cameroon. And the way things are going, by the time I post this, it'll already be midnight.
Still at my desk, like always. Tonight I'm not on a side project though — I'm on company work. Tech Lead duties, the stuff you check yourself before you can sleep easy.
Anyway. Earlier I was scrolling TikTok and stumbled on a video about the dangers of leaving debug mode on in production. Took me back two years, to when I was just starting out.
Back then I had a bad habit: debugging straight in prod. And debugging in prod means APP_DEBUG=true. So every error, Laravel would kindly show me the exact file, the exact line, the full stack trace. Handy in the moment.
No big deal back then — just my own learning projects.
But for almost two years now I've been working on
@useGenuka, used by 2500 Africans, mostly Cameroonians. The bugs pile up. I'd eventually set APP_DEBUG=false in production out of good practice. Honestly though? I did it on autopilot. Deep down I knew why, I'd just never really stopped to think about it.
That TikTok was a wake-up call.
Because that detailed Laravel error screen? It's exactly what an attacker dreams of landing on. Your file paths, your architecture, your PHP version, your whole stack. You're rolling out the red carpet without knowing it.
Knowing how to separate and configure your environments in Laravel isn't a beginner detail. It's responsibility. The moment real users are behind it, APP_DEBUG=false in prod isn't optional — it's the bare minimum.
The real lesson? Don't follow best practices just because someone told you to. Understand why they exist. That's what separates code that works from code you can trust with 2500 people.
#Laravel #PHP #Security #DevOps
ALT Jiordi's desk