ManagedQA PartnersSee plans

Error handling and recovery

Stack trace or query text in the response

Error responses include internal paths, SQL or provider messages that help an attacker and confuse a user.

Termsfault injection (making a dependency fail on purpose in staging to see what the user and the logs show) · API (the interface other software calls; tested directly, without the UI in between) · webhook (a message a provider such as Stripe sends to your server when something happens, like a payment)

mediumseverity if found in a releasesources verified 2026-09-21

Why AI-assisted code produces it

Returning the caught error message is the shortest handler. OWASP's sensitive information disclosure entry covers the same exposure through model features.

In the same 470-pull-request sample, cross-site scripting issues were up to 2.74 times more frequent in AI-co-authored pull requests; error-handling gaps were nearly 2 times more common and logic and correctness issues 75% more common.

Source: CodeRabbit, 2025-12-17 · verified 2026-09-21

The OWASP Top 10 for LLM Applications 2025 lists prompt injection (LLM01), sensitive information disclosure (LLM02), improper output handling (LLM05), excessive agency (LLM06), system prompt leakage (LLM07) and unbounded consumption (LLM10) among the ten risks.

Source: OWASP GenAI Security Project, 2025-03-12 · verified 2026-09-21

How we detect it

Trigger 4xx and 5xx responses and read the bodies.

Most associated with

Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt

Stacks: Next.js, Supabase, Firebase

Checklist items that catch it

EH-03
Error handling and recovery

Error responses contain no internal detail

automated Trigger 4xx and 5xx responses on API routes and read the bodies.

Pass when

No stack trace, file path, SQL text or provider error string appears in any response body.

medium
starter, growth, scale

Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.

More in error handling and recovery

Check your codebase for this pattern

The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.

Check your codebase for this patternAbout the audit

Related