Return generic error messages to clients and log details server-side; never expose stack traces or internals.
Verbose errors reveal stack traces, paths, and library versions that aid attackers (OWASP A05/A09).
BeforeMerge scans your pull requests against this rule and dozens more. Get actionable feedback before code ships.
Detailed error output discloses framework versions, file paths, and query structure — a roadmap for attackers. Send a generic message to the client and keep full diagnostics in server logs.
// Bad: leak the raw error to the client
app.use((err, req, res, next) => res.status(500).json({ error: err.stack }));
// Good: log internally, respond generically
app.use((err, req, res, next) => {
log.error({ err }, "request_failed");
res.status(500).json({ error: "Internal server error" });
});