Using debug log in production, is that a security concern?

I would consider it a security concern if everyone is able to view the debug.log file from the browser.

It could reveal e.g. paths, plugins and their problems.

There are though ways to restrict access to it via Nginx or Apache.

Another problem I’ve seen with logging to debug.log on production sites is that it’s not auto log-rotated, so it can grow fast for busy problematic sites. It’s easy to forget about it there, until the disk is full or the huge size starts to slow things down.

ps: I just remembered I wrote something about access restrictions here.