Verbose Error Messages
Detailed error messages, stack traces, or internal paths sent to the client or logged publicly, giving attackers a map of your application internals.
How It Works
Stack traces reveal file paths, library versions, function names, and sometimes database schemas. An attacker who sees `Error: column 'password_hash' of relation 'users' does not exist` learns your table structure. Error messages are free reconnaissance.
// BAD: raw error sent to client
export async function POST(req: Request) {
try {
const user = await db.users.create({ data: await req.json() });
return Response.json(user);
} catch (error) {
return Response.json({ error: error.message, stack: error.stack }, { status: 500 });
}
}// GOOD: generic message to client, details to logs
export async function POST(req: Request) {
try {
const user = await db.users.create({ data: await req.json() });
return Response.json(user);
} catch (error) {
console.error('[/api/users POST]', error); // server log only
return Response.json({ error: 'Something went wrong' }, { status: 500 });
}
}Real-World Example
A Next.js app in development mode was accidentally deployed to production. The detailed error overlay exposed full stack traces including absolute file paths and Prisma query internals to every visitor who triggered an error.
How to Prevent It
- Return generic error messages to clients (e.g. 'Something went wrong') in production
- Log detailed errors server-side using Sentry or structured logging — never in the response
- Ensure NODE_ENV=production in your deployment environment to disable dev error overlays
- Never send stack traces, file paths, or query details in API responses
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
Hardcoded API Keys
criticalAPI keys, tokens, or secrets written directly in source code, making them visible to anyone with repo access — including public GitHub repositories.
No Input Validation
mediumUser-supplied data sent directly to databases or external APIs without any type, format, or content validation.
Passwords Stored in Plaintext
criticalUser passwords stored as raw strings in the database instead of being hashed with a proper algorithm like bcrypt or Argon2.
JWT Without Expiration
highJWTs signed without an `exp` claim that never expire, meaning a stolen token grants permanent access with no way to revoke it.