A scan of the security-libs code base shows Debug.getInstance calls that have properties which don't appear to be documented:

java.base/share/classes/java/security/Security.java: Debug.getInstance("properties")

java.base/share/classes/sun/security/provider/SubjectCodeSource.java: sun.security.util.Debug.getInstance("auth", "\t[Auth Access]");

java.base/share/classes/sun/security/x509/CertificateExtensions.java: private static final Debug debug = Debug.getInstance("x509");

java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java: static final Debug debug = Debug.getInstance("pcsc");

SubjectCodeSource.java will probably be deleted via JDK-8294526 so that can be disregarded. The others are probably worthy of entry in the security docs guide and in the help output generated by the JDK