Medium severityGoSensitive Data ExposureMEDIUM confidence
Error Detail To Client
A raw error / exception message is returned to the HTTP client (CWE-209/CWE-200).
Standards mapping
Vulnerable vs. safe
Flagged by this check
http.Error(w, err.Error(), http.StatusInternalServerError)Passes - the safe pattern
http.Error(w, "internal server error", http.StatusInternalServerError)Why it matters & how to fix it
A raw error / exception message is returned to the HTTP client (CWE-209/CWE-200). Internal error strings can leak stack details, SQL fragments, file paths, and library versions that aid an attacker. Log the full error server-side and return a generic message plus an opaque correlation ID to the client.
References
Rule ID integsec-go-error-detail-to-client - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- JavaScript / TypeScript - Sensitive Data ExposureError Stack In Response
- JavaScript / TypeScript - Sensitive Data ExposurePII PHI In Logs
- JavaScript / TypeScript - Sensitive Data ExposureSecret In Logs
- JavaScript / TypeScript - Sensitive Data ExposureSensitive Data Client Storage
- JavaScript / TypeScript - Sensitive Data ExposureSensitive Data In URL Query
- Python - Sensitive Data ExposureFlask Traceback In Response