Even though it might not be considered production yet, I'd recommend any public site to at least turn off debug setting (and better add a catch-all route).