From what I read on another post, debuggable app might behave differently (using if-condition and checking the Manifest flag), so it's up to dev what they do with it: do they print it on LogCat? or even use publicly-displayed Toast? Other than that, dev tools are needed (e.g. LogCat, ADB, DDMS/Monitor). Android SDK Monitor can do
these things on debuggable app. Still not sure about security implication from attacker side though