Information Disclosure

Keep Internal Error Details Out of Client Responses

When an application fails, developers need enough detail to diagnose the problem. The client usually does not. If the same exception text, stack trace, database error, filesystem path, or upstream response is sent to both places, an ordinary failure can become an information leak. The consequence is not that every leaked error immediately compromises a system. The problem is that internal details can reveal data, identifiers, software structure, trust relationships, or assumptions that were never meant to cross the application’s public boundary. They can also expose secrets when sensitive values have been included in an exception or diagnostic message.