title: Is there a security risk running web apps in debug="true"?
body: <p>There are plenty of performance reasons why apps shouldn't be run in debug="true" mode (<a href="http://weblogs.asp.net/scottgu/archive/2006/04/11/442448.aspx" rel="nofollow noreferrer">good rundown from Scott Gu</a>), but are there any attack vectors exposed by this practice? It's not a question of "should you or shouldn't you", that much is clear, it's a question of whether it introduces any specific vulnerabilities.</p>
  
  <p>I'm inclined to think that the ability to <a href="https://stackoverflow.com/questions/2244293/what-is-the-non-standard-http-verb-debug-used-for-in-asp-net-iis">remotely detect it</a> combined with the known performance issues could lead to an exploit against service availability but I'd like something a bit more definite. Does anyone know of a specific attack that can be orchestrated against an app running debug="true"?</p>