BentoML

Generic exception details leak in development mode

info
securityUpdated Mar 7, 2026(via Exa)
Technologies:
How to detect:

For security reasons, generic exceptions don't expose details in production. The full traceback is logged server-side. However, in non-production environments, detailed error information may be exposed in HTTP responses.

Recommended action:

Verify production environment variables are set correctly to suppress detailed error responses. Ensure logging captures full tracebacks server-side. Review exception handlers to confirm security policy matches deployment environment.