Generic exception details leak in development mode
infosecurityUpdated Mar 7, 2026(via Exa)
Technologies:
How to detect:
For security reasons, generic exceptions don't expose details in production. The full traceback is logged server-side. However, in non-production environments, detailed error information may be exposed in HTTP responses.
Recommended action:
Verify production environment variables are set correctly to suppress detailed error responses. Ensure logging captures full tracebacks server-side. Review exception handlers to confirm security policy matches deployment environment.