Stack trace exposure (ARCH7127)

Key php.security.stack-trace-exposure · Severity warning · Category security · CWE CWE-209

Writing exception details or a stack trace to the HTTP response leaks internal file paths, library versions, and application structure to the client. Errors should be logged on the server and a generic message returned to the client.

Incorrect

<?php
try {
    process($request);
} catch (\Throwable $e) {
    http_response_code(500);
    echo $e->getMessage() . "\n" . $e->getTraceAsString();
}

Correct

<?php
try {
    process($request);
} catch (\Throwable $e) {
    error_log($e);
    http_response_code(500);
    echo 'An unexpected error occurred.';
}

Fix

Log exception details to the server log and return only a generic error message to the client.