Skip to content
Sarj Sarj Sarj Standards

no-exception-text-in-5xx-response

Keep caught exception messages and stacks out of returned 5xx JSON responses.

exceptionText Rule source Tests Catalog JSON

Why

Exception details can contain database, provider, filesystem or credential information that belongs in server-side diagnostics rather than a client response.

Fix

Return a generic public error and retain diagnostic details in server-side logs. Keep intentional public domain errors in their reviewed client-error contract.

Examples

Before — flagged Do not return a caught message as a server error
src/route.ts
function handle() {
  try {
    run();
  } catch (error) {
    return Response.json(
      { error: error instanceof Error ? error.message : "Internal server error" },
      { status: 500 },
    );
  }
}
After — preferred Keep internal failure details server-side
src/route.ts
function handle() {
  try {
    run();
  } catch (error) {
    return Response.json({ error: "Internal server error" }, { status: 500 });
  }
}

References