<p>There already was a warning about it, but it didn’t really stick out, I guess.</p>

<blockquote>
  <p><img src="https://i.sstatic.net/VAhDd.png" width="681"></p>
</blockquote>

<p>Just gave it the actual Warning style treatment, so hopefully this helps the next guy:</p>

<blockquote>
  <p><img src="https://i.sstatic.net/i3BXN.png" width="696"></p>
</blockquote>

CC BY-SA 3.0
2014-08-22T15:07:36.247Z
Thanks! @brandon-kelly That will certainly help the next guy. I'd also humbly suggest to update the "What does Dev Mode do" page to actually spell out that the information is available if not logged in. Something like "As you can probably tell, Dev Mode is definitely not suited for production environments **as it reveals sensitive data to both logged in and anonymous users**" with that fancy red exclamation point.
AbbeyDesign
CC BY-SA 3.0
2014-08-22T15:23:12.983Z
If that weren’t the case, I don’t know why we would be trying to warn against it at all. Nobody would mind if all that stuff was only revealed to admins.
Brandon Kelly
CC BY-SA 3.0
2014-08-22T15:44:46.353Z
I get that, and that page does a great deal of explaining what devmode does other than that one tiny detail. Again, coming from "coughing again" EE, one could easily make a wrong assumption.
AbbeyDesign
CC BY-SA 3.0
2014-08-22T14:49:02.363Z
2014-08-22T14:49:02.363Z
Brandon Kelly
<p>Making it only available to logged in users and/or admin, would make it impossible to debug the site as an anonymous user would see it. I'd say that's an pretty important feature which I think is wrong to remove just because someone might configure craft wrong. </p>

<p>But maybe it'd be possible to use a plugin to turn on/off devMode depending on user permissions? </p>

CC BY-SA 3.0
2014-08-22T11:03:43.950Z
2014-08-22T11:03:43.950Z
André Elvan
<p>Why don't you set up a second, password protected environment (<code>.htaccess</code> restrictions) and enable dev mode only for that environment:</p>

<pre><code>return array(

    'example.com' =&gt; array(
    ),

    'dev.example.com' =&gt; array(
        'devMode' =&gt; true,
    ),

);
</code></pre>

CC BY-SA 3.0
2014-08-22T13:16:57.977Z
2014-08-22T13:16:57.977Z
carlcs
<p>DevMode is awesome, but I wanted to post this as a bit of a heads up.</p>

<p>I'll preface to say yes, you shouldn't be developing live and yes, the docs do include a warning(yet very small and not really explaining why).</p>

<p>But I am assuming <strong>alot of you have it turned on right now.</strong></p>

<p>It reveals the craft path, file system paths, plugins installed, field handles and a whole lot of other juicy stuff.</p>

<p>To everyone.</p>

<p>Couldn't we have, or is there a way to have, this wonderful feature only available if logged in and/or admin?</p>

CC BY-SA 3.0
2014-08-22T13:14:06.073Z
I mean the warning on the General Config page of the the docs.

The caution tape is clear, but if I did not understand the ramifications when I initially implemented it, it means nothing.

The warning in the docs gets lost. It's the only one on the page and styled as another variable. It probably should be big/red with a direct link to the "What does Dev Mode do?"

But then that page makes an assumption that the reader should know that this stuff is available to all users... not just Admin.

Coming from "cough" EE, turning on debugging did not reveal this stuff unless I was logged in.
AbbeyDesign
CC BY-SA 3.0
2014-08-22T13:38:28.857Z
Craft is not a new version of EE. It's doing things differently, so you can't simply assume that dev mode is available to admin users only.
carlcs
CC BY-SA 3.0
2014-08-22T13:52:50.260Z
You don't say. All I am saying is alot of the developers using craft, are/where EE developers. Yeah, I assumed wrong, I should have known better, but the docs are not clear. @carlcs
AbbeyDesign
<devmode><debugging>
DevMode Reveals Info to Everyone
# DevMode Reveals Info to Everyone

(Asked by: username_0 on 2014-08-22)

DevMode is awesome, but I wanted to post this as a bit of a heads up.

I'll preface to say yes, you shouldn't be developing live and yes, the docs do include a warning(yet very small and not really explaining why).

But I am assuming **alot of you have it turned on right now.**

It reveals the craft path, file system paths, plugins installed, field handles and a whole lot of other juicy stuff.

To everyone.

Couldn't we have, or is there a way to have, this wonderful feature only available if logged in and/or admin?

**Tags:** devmode, debugging

> **Comments:**
> **username_0**: I mean the warning on the General Config page of the the docs.  The caution tape is clear, but if I did not understand the ramifications when I initially implemented it, it means nothing.  The warning in the docs gets lost. It's the only one on the page and styled as another variable. It probably should be big/red with a direct link to the "What does Dev Mode do?"  But then that page makes an assumption that the reader should know that this stuff is available to all users... not just Admin.  Coming from "cough" EE, turning on debugging did not reveal this stuff unless I was logged in.  
> **username_1**: Craft is not a new version of EE. It's doing things differently, so you can't simply assume that dev mode is available to admin users only.  
> **username_0**: You don't say. All I am saying is alot of the developers using craft, are/where EE developers. Yeah, I assumed wrong, I should have known better, but the docs are not clear. @username_1  

---

## 3 answers

### Answer by username_2 on 2014-08-22. Score: 4

There already was a warning about it, but it didn’t really stick out, I guess.

> ![](https://i.sstatic.net/VAhDd.png)

Just gave it the actual Warning style treatment, so hopefully this helps the next guy:

> ![](https://i.sstatic.net/i3BXN.png)

> **Comments:**
> **username_0**: Thanks! @brandon-kelly That will certainly help the next guy. I'd also humbly suggest to update the "What does Dev Mode do" page to actually spell out that the information is available if not logged in. Something like "As you can probably tell, Dev Mode is definitely not suited for production environments **as it reveals sensitive data to both logged in and anonymous users**" with that fancy red exclamation point.  
> **username_2**: If that weren’t the case, I don’t know why we would be trying to warn against it at all. Nobody would mind if all that stuff was only revealed to admins.  
> **username_0**: I get that, and that page does a great deal of explaining what devmode does other than that one tiny detail. Again, coming from "coughing again" EE, one could easily make a wrong assumption.  

---

### Answer by username_3 on 2014-08-22. Score: 3

Making it only available to logged in users and/or admin, would make it impossible to debug the site as an anonymous user would see it. I'd say that's an pretty important feature which I think is wrong to remove just because someone might configure craft wrong.

But maybe it'd be possible to use a plugin to turn on/off devMode depending on user permissions?


---

### Answer by username_1 on 2014-08-22. Score: 1

Why don't you set up a second, password protected environment (.htaccess restrictions) and enable dev mode only for that environment:
return array(

    'example.com' => array(
    ),

    'dev.example.com' => array(
        'devMode' => true,
    ),

);


---

