API 500 responses disclose full tracebacks with filesystem paths #192

New issue

Open

opened 2026-09-09 15:05:32 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-09 15:05:32 +00:00

Owner

Summary

helpers/api.py:113-116 returns format_error(e) (which embeds the full traceback) directly in 500 responses. This leaks absolute paths, internal module names, and exception messages that may contain credential fragments. It also violates the api/AGENTS.md contract: "Do not return unfiltered exception details to clients."

Suggested fix

Return a generic 500 message to clients; log the traceback server-side only (PrintStyle/log file).

Mirrored from lost-rob0t/a0-symbolics#80 via tracker sync.

## Summary `helpers/api.py:113-116` returns `format_error(e)` (which embeds the full traceback) directly in 500 responses. This leaks absolute paths, internal module names, and exception messages that may contain credential fragments. It also violates the `api/AGENTS.md` contract: "Do not return unfiltered exception details to clients." ## Suggested fix Return a generic 500 message to clients; log the traceback server-side only (PrintStyle/log file). --- *Mirrored from [`lost-rob0t/a0-symbolics#80`](https://github.com/lost-rob0t/a0-symbolics/issues/80)* via tracker sync.