API error disclosure checker

Stack traces: a frame list naming source files and line numbers, which maps your directory structure and your dependency versions in one response.

Database errors: driver text quoting a failed statement, which usually names a table and one or more columns.

Debug output: the expanded error pages frameworks render when a debug flag is left on, which routinely include the environment and sometimes configuration values.

Absolute paths: a filesystem path from the server appearing anywhere in the body, which tells a reader the deployment layout and often the account the process runs as.

Errors are normal. An API that never returns a 500 is an API nobody uses. What is being examined is what the client is told when one happens.

The useful version of that answer is short: a status code, a stable error identifier, and a correlation id the caller can quote in a support request.

Everything the operator needs belongs in the server log, keyed by that same correlation id. Nothing is lost by keeping it there — the detail moves, it does not disappear.

This is also the cheapest of all hardening work: it is a configuration flag in most frameworks, and it changes no application logic.

A framework debug page returned from a production hostname. This is the highest-value finding here, because those pages frequently render environment variables alongside the trace.

A database message quoted verbatim in the response body, which gives away table and column names.

A stack trace on a validation failure rather than on a crash — a sign that errors are not handled at all, only propagated.

A message that differs depending on whether a record exists, which lets a caller confirm identifiers one request at a time without ever seeing the data.

Only responses actually received are read. No input is crafted to provoke a failure, so an error path never exercised during the scan is never seen.

Detection is by pattern. An unusual error format may not be recognised, and a clean result means none of the known shapes appeared in what was observed.

Response bodies are examined, never stored or displayed in the report.

Errors that only occur under load or on a specific record are outside anything an external scan can reach.

`api.errors.disclosure` reads the observed public responses for stack traces, database errors, debug flags and server paths.

`api.surface.detected` decides which endpoints are observed in the first place, so this check never reaches further than the discovered inventory.

After a deployment to a new environment, because a debug flag that was correct in staging is the single most common way a debug page reaches production.

After a framework major upgrade, since default error handling is frequently reset and the old suppression no longer applies.

When an error-tracking service is introduced, as the same change that starts reporting traces to a dashboard sometimes starts returning them to clients too.