For security reasons debug => true in config.php should never be in production systems

[cdamken]

when you set 'debug'=>true in the config.php exceptions will show the trace on the web interface, inclusive passwords in plain text!

This is a good reason not to use it in production

[settermjd]

Thanks for creating this, @cdamken. Definitely top of the priority list atm.