Exposure
Error messages reveal how your app is built
Verbose error messages
What this means
On failure your app shows visitors technical details: server file paths, database queries, library versions.
Why it matters
These details are used to look up ready-made attacks: it is now known what you run and which version. Sometimes the data itself appears in the error text.
How to fix it
- Show users a generic message and write details to your logs.
- Disable verbose errors in production.
Prompt for your AI agent
Replace verbose technical errors with a generic user-facing message and keep the details in server logs only.
Verify the fix: trigger an error and confirm no technical details appear in the response
Is your app doing this?
Find out in about a minute — the first scan is free.