Recently I made a program. I forget to delete 2 line of codes. That mistake cost me $800 per day every day.
I was programming with PHP. If a visitor uses proxy it redirect somewhere else. Using debugger was impossible because some code contains ioncube. Because the program simply redirect somewhere else no matter what, it's hard to see which part of the code is executed.
So I put a bunch debugging info everywhere. I thought I'll delete them latter anyway.
The most natural way to debug is of course to put debugging info into a file. The problem is I often use proxy. So after I change the program, I often have to download the text file with filezilla. Often the text file does not show what I think it should show. Finally I decided to just display error on the web.
I considered having debugging mode. However, I am afraid I will forget to delete debugging info.
I considered having debugging mode if user do ?debuggingmode=1 for example. However, I was paranoid that somehow my competitor can guess the secret keyword.
I deleted most debugging info. I forget to delete one and that one only show up if users use proxy from the right country. Turns out I do not have proxy from the right country and didn't realize that. After the program works for 24 hours, I uploaded that to my main domain.
My competitor, using proxy, see the debugging code. He copy the idea and that's how I lost $800 per day.
In retrospect, I really have a hard time seeing where I went wrong. I have been super careful. Yet it happened.
How should one debug a PHP web application securely without exposing secrets to competitors?