Two contexts, two detail levels
APP_DEBUG=true
On your computer: message, file, line, and trace can help fix the problem.
APP_DEBUG=false
On the public site: visitors receive a safe explanation, without paths or internal traces.
The log tells the incident story
By default, errors go to runtime/storage/logs/application.log. Every JSON line contains time, level, message, and context. Common sensitive fields are replaced with [REDACTED].
{
"level": "error",
"message": "Unhandled application exception",
"context": {
"request_id": "a13f…",
"method": "GET",
"path": "/books",
"exception": "RuntimeException"
}
}The identifier connects page and log
PHPAML adds X-Request-ID to the response. During an unexpected error, an identifier appears in the safe page and log. Users can report it without revealing internal details.
Never log a password
Redaction recognizes sensitive keys, but a secret embedded in free text may still be recorded.