Access and configuration
Fail without leaking internals
Return useful public errors while keeping stack traces, queries, paths, tokens, and infrastructure details in protected diagnostics.
8 minute lesson
Errors help users recover and help attackers learn. Separate the public message from the private diagnostic record.
Use stable error codes and a request ID in public responses. Record the detailed cause internally with safe structured fields. Disable development error pages in production and test unexpected exceptions, not only validation failures.
A database outage returns a stack trace containing the SQL query, filesystem path, and internal host. The error helps the user no more than a safe failure would.
Removing all detail can make support impossible. Return a stable public code and request ID while keeping the protected diagnostic record.
Trigger validation, storage, and unexpected runtime failures in production mode. Save public responses and internal events, then prove the response contains no stack, query, path, host, or secret while the request ID connects both sides.
Lesson completed