I've been writing a Django app and almost published it with debug mode on. Django's documentation indicates
Never deploy a site into production with DEBUG turned on.
Did you catch that? NEVER deploy a site into production with DEBUG turned on.
One of the main features of debug mode is the display of detailed error pages. If your app raises an exception when DEBUG is True, Django will display a detailed traceback, including a lot of metadata about your environment, such as all the currently defined Django settings (from settings.py).
So I'm wondering how much information could a malicious attacker actually gain in a typical app? Users logins? All your code?