Answers.Body: <p>There already was a warning about it, but it didn’t really stick out, I guess.</p>
  
  <blockquote>
    <p><img src="https://i.sstatic.net/VAhDd.png" width="681"></p>
  </blockquote>
  
  <p>Just gave it the actual Warning style treatment, so hopefully this helps the next guy:</p>
  
  <blockquote>
    <p><img src="https://i.sstatic.net/i3BXN.png" width="696"></p>
  </blockquote>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-08-22T15:07:36.247Z
Answers.Text: Thanks! @brandon-kelly That will certainly help the next guy. I'd also humbly suggest to update the "What does Dev Mode do" page to actually spell out that the information is available if not logged in. Something like "As you can probably tell, Dev Mode is definitely not suited for production environments **as it reveals sensitive data to both logged in and anonymous users**" with that fancy red exclamation point.
Answers.UserDisplayName: AbbeyDesign
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-08-22T15:23:12.983Z
Answers.Text: If that weren’t the case, I don’t know why we would be trying to warn against it at all. Nobody would mind if all that stuff was only revealed to admins.
Answers.UserDisplayName: Brandon Kelly
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-08-22T15:44:46.353Z
Answers.Text: I get that, and that page does a great deal of explaining what devmode does other than that one tiny detail. Again, coming from "coughing again" EE, one could easily make a wrong assumption.
Answers.UserDisplayName: AbbeyDesign
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-08-22T14:49:02.363Z
Answers.LastActivityDate: 2014-08-22T14:49:02.363Z
Answers.UserDisplayName: Brandon Kelly
Answers.Body: <p>Making it only available to logged in users and/or admin, would make it impossible to debug the site as an anonymous user would see it. I'd say that's an pretty important feature which I think is wrong to remove just because someone might configure craft wrong. </p>
  
  <p>But maybe it'd be possible to use a plugin to turn on/off devMode depending on user permissions? </p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-08-22T11:03:43.950Z
Answers.LastActivityDate: 2014-08-22T11:03:43.950Z
Answers.UserDisplayName: André Elvan
Answers.Body: <p>Why don't you set up a second, password protected environment (<code>.htaccess</code> restrictions) and enable dev mode only for that environment:</p>
  
  <pre><code>return array(
  
      'example.com' =&gt; array(
      ),
  
      'dev.example.com' =&gt; array(
          'devMode' =&gt; true,
      ),
  
  );
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-08-22T13:16:57.977Z
Answers.LastActivityDate: 2014-08-22T13:16:57.977Z
Answers.UserDisplayName: carlcs
Body: <p>DevMode is awesome, but I wanted to post this as a bit of a heads up.</p>
  
  <p>I'll preface to say yes, you shouldn't be developing live and yes, the docs do include a warning(yet very small and not really explaining why).</p>
  
  <p>But I am assuming <strong>alot of you have it turned on right now.</strong></p>
  
  <p>It reveals the craft path, file system paths, plugins installed, field handles and a whole lot of other juicy stuff.</p>
  
  <p>To everyone.</p>
  
  <p>Couldn't we have, or is there a way to have, this wonderful feature only available if logged in and/or admin?</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2014-08-22T13:14:06.073Z
Comments.Text: I mean the warning on the General Config page of the the docs.
  
  The caution tape is clear, but if I did not understand the ramifications when I initially implemented it, it means nothing.
  
  The warning in the docs gets lost. It's the only one on the page and styled as another variable. It probably should be big/red with a direct link to the "What does Dev Mode do?"
  
  But then that page makes an assumption that the reader should know that this stuff is available to all users... not just Admin.
  
  Coming from "cough" EE, turning on debugging did not reveal this stuff unless I was logged in.
Comments.UserDisplayName: AbbeyDesign
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2014-08-22T13:38:28.857Z
Comments.Text: Craft is not a new version of EE. It's doing things differently, so you can't simply assume that dev mode is available to admin users only.
Comments.UserDisplayName: carlcs
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2014-08-22T13:52:50.260Z
Comments.Text: You don't say. All I am saying is alot of the developers using craft, are/where EE developers. Yeah, I assumed wrong, I should have known better, but the docs are not clear. @carlcs
Comments.UserDisplayName: AbbeyDesign
Tags: <devmode><debugging>
Title: DevMode Reveals Info to Everyone
ThreadText: # DevMode Reveals Info to Everyone
  
  (Asked by: username_0 on 2014-08-22)
  
  DevMode is awesome, but I wanted to post this as a bit of a heads up.
  
  I'll preface to say yes, you shouldn't be developing live and yes, the docs do include a warning(yet very small and not really explaining why).
  
  But I am assuming **alot of you have it turned on right now.**
  
  It reveals the craft path, file system paths, plugins installed, field handles and a whole lot of other juicy stuff.
  
  To everyone.
  
  Couldn't we have, or is there a way to have, this wonderful feature only available if logged in and/or admin?
  
  **Tags:** devmode, debugging
  
  > **Comments:**
  > **username_0**: I mean the warning on the General Config page of the the docs.  The caution tape is clear, but if I did not understand the ramifications when I initially implemented it, it means nothing.  The warning in the docs gets lost. It's the only one on the page and styled as another variable. It probably should be big/red with a direct link to the "What does Dev Mode do?"  But then that page makes an assumption that the reader should know that this stuff is available to all users... not just Admin.  Coming from "cough" EE, turning on debugging did not reveal this stuff unless I was logged in.  
  > **username_1**: Craft is not a new version of EE. It's doing things differently, so you can't simply assume that dev mode is available to admin users only.  
  > **username_0**: You don't say. All I am saying is alot of the developers using craft, are/where EE developers. Yeah, I assumed wrong, I should have known better, but the docs are not clear. @username_1  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_2 on 2014-08-22. Score: 4
  
  There already was a warning about it, but it didn’t really stick out, I guess.
  
  > ![](https://i.sstatic.net/VAhDd.png)
  
  Just gave it the actual Warning style treatment, so hopefully this helps the next guy:
  
  > ![](https://i.sstatic.net/i3BXN.png)
  
  > **Comments:**
  > **username_0**: Thanks! @username_2 That will certainly help the next guy. I'd also humbly suggest to update the "What does Dev Mode do" page to actually spell out that the information is available if not logged in. Something like "As you can probably tell, Dev Mode is definitely not suited for production environments **as it reveals sensitive data to both logged in and anonymous users**" with that fancy red exclamation point.  
  > **username_2**: If that weren’t the case, I don’t know why we would be trying to warn against it at all. Nobody would mind if all that stuff was only revealed to admins.  
  > **username_0**: I get that, and that page does a great deal of explaining what devmode does other than that one tiny detail. Again, coming from "coughing again" EE, one could easily make a wrong assumption.  
  
  ---
  
  ### Answer by username_3 on 2014-08-22. Score: 3
  
  Making it only available to logged in users and/or admin, would make it impossible to debug the site as an anonymous user would see it. I'd say that's an pretty important feature which I think is wrong to remove just because someone might configure craft wrong.
  
  But maybe it'd be possible to use a plugin to turn on/off devMode depending on user permissions?
  
  
  ---
  
  ### Answer by username_1 on 2014-08-22. Score: 1
  
  Why don't you set up a second, password protected environment (`.htaccess` restrictions) and enable dev mode only for that environment:
  
  ```
  return array(
  
      'example.com' => array(
      ),
  
      'dev.example.com' => array(
          'devMode' => true,
      ),
  
  );
  
  ```
  
  
  ---
  
  