Stack trace exposure (ARCH324)

Key dotnet.security.stack-trace-exposure · Severity warning · Category security · CWE CWE-209

Returning exception messages or stack traces directly to clients leaks internal file paths, library versions, and application structure. Attackers can use this information for reconnaissance.

Incorrect

catch (Exception ex)
{
    return StatusCode(500, ex.ToString());
}

Correct

catch (Exception ex)
{
    _logger.LogError(ex, "Operation failed");
    return StatusCode(500, "An unexpected error occurred.");
}

Fix

Log exception details only on the server and return a generic error message or correlation id to the client.