title: What's the risk of deploying debug symbols (pdb file) in a production environment?
body: <p>I have an application that logs exception strack traces and I wanted those stack traces to include file names and line numbers when deployed in production.  I figured out how to deploy the debug symbols w/ the assembly, but in the process of researching the issue I ran accross <a href="https://stackoverflow.com/questions/628565/display-lines-number-in-stack-trace-for-net-assembly-in-release-mode">this question</a>, which implies that it's not a good idea to include pdb files in a production environment.  A comment to the accepted answer says "...debugging information can give away sensitive data and be an attack vector. Depending on what your app is."</p>
  
  <p>So what sort of sensitive data might be exposed?  How can debug symbols be used to compromise an application?  I'm curious about the technical details, but what I'm really looking for is a practical way to evaluate the risk of including debug symbols for any given application and production environment.  Or to put it another way: what's the worst that could happen?</p>
  
  <p><strong>EDIT:</strong> follow-up question/clarification</p>
  
  <p>So based on everyone's answers so far, it seems like this question can be simplified a bit for .NET applications.  This bit from the <a href="http://www.wintellect.com/CS/blogs/jrobbins/archive/2009/05/11/pdb-files-what-every-developer-must-know.aspx" rel="noreferrer">John Robbins blog</a> linked in <a href="https://stackoverflow.com/questions/1307482/whats-the-risk-of-deploying-debug-symbols-pdb-file-in-a-production-environment/1307544#1307544">Michael Maddox's answer</a> kind of leaped out at me:</p>
  
  <blockquote>
    <p>A .NET PDB only contains two pieces of
    information, the source file names and
    their lines and the local variable
    names. All the other information is
    already in the .NET metadata so there
    is no need to duplicate the same
    information in a PDB file.</p>
  </blockquote>
  
  <p>To me, this reiterates what others have been saying about Reflector, with the implication being that the real issue is access to the assemblies.  Once that's been determined, the only decision to make with respect to PDBs is whether or not you care about exposing file names, line numbers, and local variable names (assuming that you're not showing stack traces to end users to begin with).  Or have I oversimplified this too much?</p>