Medium severityJavaScript / TypeScriptSensitive Data ExposureHIGH confidence
Error Stack In Response
An exception stack trace is returned to the client, leaking internal paths, dependency versions, and logic.
Standards mapping
Vulnerable vs. safe
Flagged by this check
res.status(500).send(err.stack);Passes - the safe pattern
res.status(500).send("Internal Server Error");Why it matters & how to fix it
An exception stack trace is returned to the client, leaking internal paths, dependency versions, and logic. Return a generic error message and log the detail server-side only.
References
Rule ID integsec-js-error-stack-in-response - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- JavaScript / TypeScript - Sensitive Data ExposurePII PHI In Logs
- JavaScript / TypeScript - Sensitive Data ExposureSecret In Logs
- JavaScript / TypeScript - Sensitive Data ExposureSensitive Data Client Storage
- JavaScript / TypeScript - Sensitive Data ExposureSensitive Data In URL Query
- Python - Sensitive Data ExposureFlask Traceback In Response
- Python - Sensitive Data ExposureHardcoded PII Literal