diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f98f124..fa336f6 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2,7 +2,7 @@ stages:
   - deploy
 
 variables:
-  BASE_DIRS: "src public api partials tools debug config"
+  BASE_DIRS: "api config data debug modules partials public src tools"
   CONFIG_BASE_DIR: "config"
   LOCAL_ROOT: "/mnt/nexusserver"
   # SITE_DOMAIN_DIR wurde entfernt
diff --git a/public/assets/js/app.js b/public/assets/js/app.js
index 8849e63..13562d0 100755
--- a/public/assets/js/app.js
+++ b/public/assets/js/app.js
@@ -58,6 +58,10 @@
   const loadList = async () => {
     try {
       const res = await fetch('/debug?list=1', { cache: 'no-store' });
+      if (!res.ok) {
+        listEl.innerHTML = `<li class=\"muted\">Fehler: ${res.status}</li>`;
+        return;
+      }
       const files = await res.json();
       listEl.innerHTML = '';
       files.forEach((f) => {
@@ -75,16 +79,24 @@
       if (files.includes('oidc_login.log')) {
         loadFile('oidc_login.log');
       }
-    } catch (e) {}
+    } catch (e) {
+      listEl.innerHTML = '<li class=\"muted\">Fehler beim Laden der Logs.</li>';
+    }
   };
 
   const loadFile = async (name) => {
     activeFile = name;
     try {
       const res = await fetch(`/debug?raw=1&file=${encodeURIComponent(name)}&tail=200`, { cache: 'no-store' });
+      if (!res.ok) {
+        contentEl.textContent = `Fehler: ${res.status}`;
+        return;
+      }
       const text = await res.text();
       contentEl.textContent = formatLog(text);
-    } catch (e) {}
+    } catch (e) {
+      contentEl.textContent = 'Fehler beim Laden der Datei.';
+    }
   };
 
   const formatLog = (text) => {
diff --git a/public/page/debug.php b/public/page/debug.php
index 6f0e5d0..a911089 100644
--- a/public/page/debug.php
+++ b/public/page/debug.php
@@ -1,4 +1,16 @@
 <?php
+$isList = (isset($_GET['list']) && $_GET['list'] === '1');
+$isRaw = (isset($_GET['raw']) && $_GET['raw'] === '1');
+
+if ($isList || $isRaw) {
+    if (!auth_is_admin()) {
+        http_response_code(403);
+        header('Content-Type: text/plain; charset=utf-8');
+        echo 'forbidden';
+        return;
+    }
+}
+
 require_admin();
 
 if (!defined('APP_DEBUG_TOOL') || !APP_DEBUG_TOOL) {
@@ -8,6 +20,12 @@ if (!defined('APP_DEBUG_TOOL') || !APP_DEBUG_TOOL) {
 
 $debugDir = __DIR__ . '/../../debug';
 if (!is_dir($debugDir)) {
+    if ($isList || $isRaw) {
+        http_response_code(404);
+        header('Content-Type: text/plain; charset=utf-8');
+        echo 'debug_dir_missing';
+        return;
+    }
     echo '<div class="card">Debug-Verzeichnis fehlt.</div>';
     return;
 }
@@ -28,13 +46,13 @@ if ($selected !== '' && preg_match('/^[a-zA-Z0-9._-]+$/', $selected)) {
     }
 }
 
-if (isset($_GET['list']) && $_GET['list'] === '1') {
+if ($isList) {
     header('Content-Type: application/json; charset=utf-8');
     echo json_encode($files);
     return;
 }
 
-if (isset($_GET['raw']) && $_GET['raw'] === '1') {
+if ($isRaw) {
     header('Content-Type: text/plain; charset=utf-8');
     $tail = isset($_GET['tail']) ? (int)$_GET['tail'] : 0;
     if ($tail > 0 && $content !== null) {