Stop leaking your application's internals. Symfony misconfigurations, specifically leaving debug mode active or the profiler exposed in production, are low-hanging fruit for any competent attacker. This 'feature' provides a roadmap of your filesystem, environment variables, and database schema. Lock it down or get owned.

The Vulnerable Pattern

# .env file
APP_ENV=prod
APP_DEBUG=1
APP_SECRET=ChangeMe
config/bundles.php
return [
Symfony\Bundle\WebProfilerBundle\WebProfilerBundle::class => [‘all’ => true],
];

The Secure Implementation

The vulnerability stems from three critical failures: 1. APP_DEBUG=1 in production forces Symfony to display verbose 'Ghost' error pages containing stack traces and sensitive ENV variables. 2. A weak or default APP_SECRET allows attackers to forge signed cookies and bypass CSRF protections. 3. Loading the WebProfilerBundle in 'all' environments exposes the /_profiler endpoint, which leaks every database query, security token, and request payload to the public. The fix involves disabling debug mode, generating a high-entropy secret, and strictly scoping dev-only bundles to the 'dev' environment.

# .env file
APP_ENV=prod
APP_DEBUG=0
# Generate a 32-byte hex string for APP_SECRET
APP_SECRET=266978437996f9208034a7430102660a
config/bundles.php
return [
// Ensure Profiler is restricted to dev/test environments only
Symfony\Bundle\WebProfilerBundle\WebProfilerBundle::class => [‘dev’ => true, ‘test’ => true],
];
config/packages/prod/framework.yaml
framework:
php_errors:
log: true