Stack trace exposure (ARCH2127)

Key python.security.stack-trace-exposure · Severity warning · Category security · CWE CWE-209

Writing exception details or a stack trace into an HTTP response leaks internal implementation to clients and widens the attack surface. Return a generic error message.

Incorrect

import traceback
from flask import jsonify

def handle(e):
    return jsonify(error=traceback.format_exc()), 500

Correct

import logging
from flask import jsonify

def handle(e):
    logging.exception("unhandled error")
    return jsonify(error="Internal server error"), 500

Fix

Write stack traces to the server log, not the client, and return a generic error message to the client.