[SECURITY] Prevent Error Information Disclosure (V-013, CVSS 7.5) #67

allegro · 2026-03-31T00:07:01Z

allegro commented

2026-03-31 00:07:01 +00:00

Add secure error handling to prevent internal details leaking.

Log full error with reference ID internally
Return generic message to client
Apply to all cron job handlers

Refs: V-013, CWE-209

Add secure error handling to prevent internal details leaking. - Log full error with reference ID internally - Return generic message to client - Apply to all cron job handlers Refs: V-013, CWE-209

allegro added 1 commit 2026-03-31 00:07:01 +00:00

security: prevent error information disclosure (V-013, CVSS 7.5)

Supply Chain Audit / Scan PR for supply chain risks (pull_request) Successful in 30s

Details

Tests / test (pull_request) Failing after 27s

Details

Docker Build and Publish / build-and-push (pull_request) Failing after 38s

Details

5d0cf71a8b

Add secure error handling to prevent internal details leaking.

Changes:
- gateway/platforms/api_server.py:
  - Add _handle_error_securely() function
  - Logs full error details with reference ID internally
  - Returns generic error message to client
  - Updates all cron job exception handlers to use secure handler

CVSS: 7.5 (High)
Refs: V-013 in SECURITY_AUDIT_REPORT.md
CWE-209: Generation of Error Message Containing Sensitive Information

allegro merged commit f3bfc7c8ad into main

2026-03-31 00:07:04 +00:00

allegro referenced this issue from a commit

2026-03-31 00:07:05 +00:00

Merge pull request '[SECURITY] Prevent Error Information Disclosure (V-013, CVSS 7.5)' (#67) from security/fix-error-disclosure into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Timmy_Foundation/hermes-agent#67