Stack trace exposure (ARCH6127)

Key ruby.security.stack-trace-exposure · Severity warning · Category security · CWE CWE-209

Writing exception details or a stack trace to the HTTP response leaks internal structure, file paths, and library versions to the client.

Incorrect

rescue => e
  render plain: e.backtrace.join("\n"), status: 500
end

Correct

rescue => e
  Rails.logger.error(e.full_message)
  render plain: "Internal error", status: 500
end

Fix

Log exception details server-side; return only a generic error message to the client.