When PHP throws an exception, the stack trace lists each function call along the way, and by default it also shows the arguments passed to each one. Those arguments can include passwords, tokens or other private data. This RFC from Andrew Lyons turns zend.exception_ignore_args on by default, so stack traces leave argument values out.

Why change it

The setting arrived in PHP 7.4, and the docs recommended setting it to On in production. But the built-in default stayed Off, and so did the development php.ini. The RFC wants PHP to be safer out of the box.

The setting affects what you see in:

  • Throwable::getTrace() and Throwable::getTraceAsString()
  • Exception::$trace and Error::$trace
  • The default exception and error handler

Why #[\SensitiveParameter] isn't enough

PHP 8.2 added the #[\SensitiveParameter] attribute to hide a single value in a trace. It only hides the value in the function where you put the attribute, though. If you pass that value on to another function, it shows up again:

public function doSomething(
    #[\SensitiveParameter] $sensitive,
): void {
    $this->doSomethingElse($sensitive);
}

/*
# 0 /in/ve6SG(7): Example->doSomethingElse('MySecretValue')
# 1 /in/ve6SG(19): Example->doSomething(Object(SensitiveParameterValue))
*/

To rely on the attribute, you'd have to mark every function the value passes through, including code in libraries you don't control.

The RFC also considers turning off display_errors instead. It argues that showing errors is useful for debugging, and that any change there should be a separate RFC.

What it means for existing code

The RFC expects no backward compatibility breaks, since code that reads trace arguments already has to handle both settings. If you want the values back, set zend.exception_ignore_args to Off, which frameworks can do with ini_set(). debug_backtrace() and debug_print_backtrace() aren't affected.

Where it stands

The RFC is still under discussion. The page plans two votes: one to change the built-in default, and a second to change the development php.ini, which only counts if the first passes. It targeted PHP 8.5.

We list it as inactive because the page hasn't changed since April 2025 and no vote was ever held. Its PHP 8.5 target has since shipped.