I'm not really sure it is a valid security concern. Putting any application in debug mode is going to expose a lot of information (even decrypted) to users. It's kind of assumed that you'll never be using debug mode in production.

A notification is warranted, though, "Hey you should probably not use this in production."