Error page leaks a stack trace
Your error page returns a raw stack trace to visitors.
Why it matters
Your error page returns a raw stack trace to visitors. It reveals server-side file paths, your framework and its version, and the internal call structure of your code — the reconnaissance an attacker would otherwise have to guess at, including which known vulnerabilities your exact versions are subject to. Users should see a friendly error page; the trace belongs in your logs.
How ShipReady detects it
Framework debug-page and stack-trace disclosure. A production app should never render a framework debug page. When it does, the page hands an attacker the application's internals for free — and in Werkzeug's case, an interactive console. DETECTION IS PASSIVE. We request one path that will not exist and read what comes back. We never attempt to *cause* an error: forcing a 500 would require sending malformed or malicious input, which is exploitation, not scanning. That limits us to debug pages the app already shows on an ordinary miss — which is exactly the Django/Rails/ASP.NET DEBUG case, the most common one in practice. Only the error-probe response is analyzed, never the homepage. A homepage can legitimately contain the words "Traceback (most recent call last)" (a blog post about debugging, documentation, a tutorial); a 404 response body containing a live traceback cannot be explained that way. Scoping the analysis this way removes that whole class of false positive rather than trying to filter it.
Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.
How to fix it
This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
Your application returns raw stack traces to visitors. Add a global error handler that logs the full trace server-side and returns a generic error page to the client, and disable verbose/debug error output in your production configuration. Verify by requesting a non-existent path and confirming the response contains no file paths, framework versions, or trace output.
Frequently asked questions
- What does "Error page leaks a stack trace" mean?
- Your error page returns a raw stack trace to visitors.
- How serious is it?
- ShipReady rates this medium. Fix soon. Meaningfully weakens a defence or degrades how the site works.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.
- Can I check my own site?
- Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check.
Related checks
Does your site have this?
ShipReady checks this and 73 other things across up to ten pages of your site. Free, no signup.
Scan my site