# Verbose Error Messages Exposed to Clients

> Detects stack traces, exception details, and internal error information sent in HTTP responses to end users.

- Skill: `zakirkun/verbose-error-messages-exposed-to-clients` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/verbose-error-messages-exposed-to-clients`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/verbose-error-messages-exposed-to-clients/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/verbose-error-messages-exposed-to-clients

---


# Verbose Error Messages Exposed to Clients

## Overview
Exposing detailed error information to end users reveals:
- **Stack traces**: Internal file paths, function names, code structure
- **Database errors**: Table names, column names, SQL queries
- **Framework errors**: Version information, configuration details
- **Exception messages**: Business logic and data structure hints

This information directly aids attackers in crafting more targeted attacks.

## Remediation
- Return generic error messages to clients (`Internal Server Error`, `Something went wrong`)
- Log detailed error information server-side for debugging
- Use custom error handlers in your framework
- Set appropriate HTTP status codes without leaking implementation details

**Vulnerable:**
```js
app.use((err, req, res, next) => {
    res.status(500).json({ error: err.stack }); // Exposes stack trace!
});
```

**Safe:**
```js
app.use((err, req, res, next) => {
    logger.error(err.stack); // Log internally
    res.status(500).json({ error: 'Internal Server Error' });
});
```