> In your production environment, this value should always be false. If the variable is set to true in production, you risk exposing sensitive configuration val

> In your production environment, this value should always be false. If the variable is set to true in production, you risk exposing sensitive configuration values to your application's end users. It's still a footgun. It's pretty clear that this shouldn't be done, so why allow it this easily? In prod it should emit a log message saying "you cannot do that. if you really, need to follow these steps: <something cumbersome like placing a file somewhere with some dedicated end date for debug mode, or scoping rules>"