Error Handling Security

Prevent stack traces, database errors, and internal details from leaking to attackers. Verbose errors in production are a reconnaissance goldmine -- they reveal your framework, database structure, file paths, and dependencies.

The Rule

NEVER expose internal error details to users. ALWAYS return generic messages externally and log details internally.

What Leaks Look Like

BAD -- Exposes everything to attacker:

{
  "error": "ER_NO_SUCH_TABLE: Table 'myapp_prod.users_v2' doesn't exist",
  "stack": "Error: ER_NO_SUCH_TABLE\n    at /app/src/services/user.ts:47:12\n    at Pool.query (/app/node_modules/mysql2/promise.js:94:22)",
  "sql": "SELECT * FROM users_v2 WHERE email = 'admin@test.com'"
}