Home / patterns

Error messages that leak stack traces, queries or keys

Quick answer: AI-generated apps often return raw errors to the browser, exposing file paths, SQL, environment details or even keys. Return a generic message to users and log details server-side.

Last updated October 16, 2026

Steps

  1. On your own app, trigger a few errors: a bad ID in a URL, an empty form, a logged-out API call.
  2. Look at the response body and the browser console: stack traces, SQL text, file paths or env values should not appear.
  3. Wrap API handlers so users get a short generic message plus a request ID.
  4. Send full error details to server logs or an error tracker instead.
  5. Make sure production builds don't run in debug or development mode.

Why it matters

Detailed errors help attackers map your database and code. OWASP lists improper error handling under security misconfiguration.

Sources

OWASP Top 10 A05: Security Misconfiguration — https://owasp.org/Top10/A05_2021-Security_Misconfiguration/

OWASP Error Handling Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Error_Handling_Cheat_Sheet.html

Want an expert to check your app?

VibeRescue checks are coming soon. Join the waitlist — we only check apps you own, after verification. No scanning product is live yet.

Join the waitlist

Vibe Security Weekly

One email a week with new failure patterns and how to fix them.

Free. Unsubscribe anytime. We'll never sell your email.