Hey thanks for this. Yeah I'm a bit cowboyish in that regard haha. I'll turnout off when I go to put it out into the world for real.

For now I'm really appreciating the feedback I'm getting (only started working on this 4 nights ago).

I understand the motivation to keep it in debug when you first put it online, but the HN community is rightly quite hawkish on this type of thing, it is a potentially massive security risk.

If your hope is that you could gain some initial customers from here, it will almost certainly put a significant number off of giving it a go. I know you are super early with a MVP but as you are asking people to consider paying you already, I hope you reconsider.

Exactly won't be long before his Stripe environment variables are leaked through the debug error message.

Honestly, not looking for users - I'm looking for feedback, which I'm getting by the bucketload and it is amazing!

Also running on single VM in a GCP zone is a disaster waiting to happen.

Why? I've been running services on single instances for 13 years and it's been ok. Not everything has to be webscale.

It's not about being webscale it's about being professional.

It's not professionalism to increase the cost of your service regardless of your needs. Maybe 99.99% is good enough for the OP's price point, and if I want five nines I'll pay for Zendesk.

In this sort of situation, using multiple servers is likely to reduce reliability. Needless complexity is not a good thing. Making a system distributed has a real cost.

Upping this. If you hit a 404 page it seems a ton of your server side source code is visible.

The code revealed there is basically all open source Laravel framework stuff, but yeah, having APP_DEBUG=true turned on has potential to expose other more meaningful vulnerabilities.

It also offers some performance benefits IIRC

I’m guessing it’s also the cause of the JavaScript using inline source maps, meaning that it’s shipping over 2MB to do⸺ I think it’s currently literally nothing but the click handler to expand the FAQs (which would be better not collapsed in the first place, or failing that, implemented with the <details> element).

No, that's (typically; in the default setup, at the very least; you could manage to make them related but it'd be a bit silly and take specific efforts) independent of APP_DEBUG.

the real danger is that app_debug does less security checks in the middleware layers.

Debug turned off :-)