Why not check like this?

````
if (getenv('CAKEPHP_DEBUG')) { 
````

This would mean you **have to set** it if you want the debug mode.
In your solution you would have to set it for production.
In my point of view the production environment is the one that should be protected and should get the most secure default settings.