For things that are pentested/audited to some level of compliance standard this is still very much known. It's under the heading of the error message gives too

For things that are pentested/audited to some level of compliance standard this is still very much known. It's under the heading of the error message gives too much away.