Yes absolutely. In some cases it might throw out an error showing your database information. This is very unlikely though. Any private configuration you've set might be thrown onto a user page, including your pusher key, mail configuration etc. Therefor debug should only be enabled outside of production environments or when you simply need to see the error immediately. Leaving debug mode on is very unwise outside of development environments. If you want to keep it enabled you could do so by checking your IP against it:
'debug' => $_SERVER['REMOTE_ADDR'] === '<yourIp,eg:65.65.65.65>',
In case you want to activate it for a specific set of ips use in_array():
'debug' => in_array($_SERVER['REMOTE_ADDR'], ['65.65.65.65','8.8.4.4']),
Please note you'd have to have a fixed IP for this to work.
