security(api): raw backend error .message returned to clients on 500s (incl. unauthenticated share route) · Issue #2501 · chmonitor/chmonitor · GitHub
Skip to content

security(api): raw backend error .message returned to clients on 500s (incl. unauthenticated share route) #2501

Closed
#2414
#2555
Closed
security(api): raw backend error .message returned to clients on 500s (incl. unauthenticated share route)#2501
#2414
#2555
Labels
P2Medium prioritybugSomething isn't workingsecuritySecurity hardening

Description

@duyet
duyet
opened on Jul 10, 2026

share.$slug.ts returns DashboardStoreError/err.message to unauthenticated callers; browser-connections/proxy.ts, user-connections.ts and similar catch blocks do the same. Internal D1/ClickHouse/driver detail leaks in API responses while server logs already capture it (share route even has a requestId). Plan: createInternalErrorResponse helper (generic message + request id), convert 5xx sites, keep 4xx validation messages specific.

Full self-contained implementation plan: plans/84-sanitize-500-error-responses.md (audit round 4, planned at 070f5fe0a). Found by the 2026-07-10 deep audit.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    P2Medium prioritybugSomething isn't workingsecuritySecurity hardening

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions