mediumConfiguration

Verbose Error Messages in Production

Error handlers return detailed error information (stack traces, internal messages) to the client.

Why it matters

Stack traces reveal file paths, dependency versions, database connection strings, and internal logic. Attackers use this information to identify specific vulnerabilities, understand your tech stack, and craft targeted exploits. Production error responses should be generic.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Error message exposed in response
app.use((err, req, res, next) => {
  res.status(500).json({ error: err.message, stack: err.stack });
});

The smallest fix

minimal patch
// Replace detailed error responses with generic ones:
// BEFORE:
// res.status(500).json({ error: err.message, stack: err.stack });
// AFTER:
res.status(500).json({ error: 'Internal server error' });
// Log the actual error server-side:
console.error(err);

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

The file [the file] at line [the line number] returns verbose error information to clients: [the flagged code]. Replace with a generic error message and log the actual error server-side only.

How to check the fix worked

1. Trigger a server error and check the response body — it must not contain stack traces
2. Verify error details are logged server-side
3. Check that error responses use consistent format with generic messages

Further reading