Stack trace exposure (ARCH3127)

Key typescript.security.stack-trace-exposure · Severity warning · Category security · CWE CWE-209

Writing exception details and stack traces to the HTTP response leaks internal file paths and application structure to the client.

Incorrect

app.use((err, req, res, next) => {
  // Stack trace sent to the client
  res.status(500).send(err.stack);
});

Correct

app.use((err, req, res, next) => {
  logger.error(err);
  res.status(500).json({ error: "Internal Server Error" });
});

Fix

Log error details only on the server side; return a generic error message to the client.