SEC-018
Error page leaks stack traces or internals
MediumDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
The response to a missing URL for stack traces, SQL errors and debug-mode markers.
Why it matters
Stack traces reveal file paths, library versions and query structure that help attackers.
Recommended fix
Turn off debug mode in production and show a generic error page.
How to verify
Visit a missing URL on the live site and confirm only a friendly message is shown.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-018: Error page leaks stack traces or internals
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Production error pages show stack traces or debug output. Disable debug/development mode in the production build, add a generic custom error page, and log the details server-side only.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Visit a missing URL on the live site and confirm only a friendly message is shown.