Error page leaks a stack trace
A response to a randomly chosen nonexistent path contained a recognized framework debug-page or runtime stack-trace signature.
Why it matters
Detailed error pages can expose file paths, framework details, and application structure that help someone understand the system. Production users should receive a generic error page while detailed diagnostics remain in protected logs.
How ShipReady detects it
What it inspects
ShipReady makes one request for a random nonexistent path and examines that response body for exact framework debug-page signatures or one of four generic runtime-trace signatures. Framework signatures are checked first.
What triggers a finding
The rule triggers when the probe response body contains a recognized Python, Node.js, Java, or PHP stack-trace signature and no higher-priority framework debug-page signature matched.
What the evidence shows
The response to the random nonexistent-path request contained one of the scanner’s recognized generic stack-trace signatures.
Limits of this check
The scanner does not deliberately cause an application error, inspect the homepage, or test every route. It makes one probe with a ten-second timeout and does not follow redirects. This rule covers only generic trace signatures; recognized framework debug pages can produce separate findings. A signature is evidence in that response, not proof that every error path exposes a trace. If the probe receives no answer or an unanswered status, coverage may be marked incomplete.
How to fix it
Show a safe public error page
Configure production error handling to return a generic message for unexpected errors.
Keep stack traces in access-controlled server logs and give each error a request identifier that support staff can use to find the log entry.
How to verify the change
Test a nonexistent route in production
Request a path that does not exist and inspect the response body.
Expected: The public response gives a generic error message without runtime traces or framework debug details; detailed diagnostics remain in protected logs.