What is the best practice for CF error handling when it comes to handling 500 errors that happen before application.cfc or application.cfm are processed?

This depends on your application. With OnRequestStart, for example, you could check to see if the requested "page" exists and then do something else if it doesn't.

Your application.cfc/ application.cfm should be processed before your page gets processed, which would be processed before a 500 error is generated. The only chance for a 500 error otherwise is if Tomcat itself or your http connector throws it. There really isn't a way to catch those, however.

@TEMann What sorts of errors are you seeing like that?

Our security team is trying to access application.cfm directly and getting the CF excpetion error page informing that application.cfm is reserved and cannot be accessed directly. The response is a 500 error.

What would you prefer to have happen instead of seeing the 500 error?