Is it acceptable to catch all exceptions and return a 500 error in production? Why or why not?

No, it's generally *not* acceptable. While it prevents the server from crashing, it provides very little information to the client and makes debugging difficult. Catching all exceptions hides underlying problems. You should handle specific exceptions gracefully, returning appropriate HTTP status codes and informative error messages. Unhandled exceptions should be logged for investigation, but not simply masked with a generic 500 error.