Turning off debug mode in ASP.NET is one of the things that's mentioned even in the most beginner tutorials on ASP.NET security. Unfortunately, in website projects debug mode is the only way to obtain line numbers with exception stacktraces: you can't just enable PDBs while leaving the website in release mode.
Line numbers in stacktraces are exceptionally useful in figuring out the cause of those once-in-a-blue-moon exceptions that only occur in production.
Our server uses custom error handlers, and has tracing disabled. Are there any other ways in which the debug mode can be harmful for security?