PHP Oct 5, 2026
3 min read
__debugInfo() does not hide anything from dd()
The card object in my Laravel package kept its number in a private property, masked it in __debugInfo(), and marked the constructor arguments #[SensitiveParameter]. dd() printed the full card number and CVN anyway, and so did var_export() and an (array) cast. The fix was to stop storing them on the object at all.