config.filter_parameters doesn't affect debug(params)

Mmm, I can see where that logic might arise, and I'll attempt a counter thought with "if it's sensitive, it's sensitive" and the framework shouldn't be making any assumptions as to when it is or isn't suitable to be displayed. config.filter_parameters allows me to decide that I don't want certain things to show accidently outside my app code, so the framework should make that as universally applicable as possible. I can use other methods to override that if I need to from removing it, to using environments (I think), to something as barbaric as re-assigning to another var name to output if I really need to see it.

Anyway, I guess that's my 4¢. Just something to consider.

I totally agree with Rohit.

There will always be a way to somehow disclose filtered params in development. A silly example:

class SessionsController < ApplicationController
  def create
    raise params[:password] # oh no, security breach!
  end
end

You chose to display what's in params while in the development environment - that's your responsibility. Besides, as Rohit said, of course you're not working with sensitive data in development.

IMHO, this should just be marked wontfix.