Yep, it's also quite easy to leak sensitive data in errors so you shouldn't just send every error your code produces to the client. Maybe less a concern for gRP

Yep, it's also quite easy to leak sensitive data in errors so you shouldn't just send every error your code produces to the client. Maybe less a concern for gRPC as it's often used internally, but some systems still might propagate the error logs to untrusted clients. In the worst case your traceback will contain environment variables, which in turn might contain database secrets or API tokens (of course it's also bad practice storing secrets in environment variables but people still do it a lot). In our projects we solve this by implementing internal and external error types. External errors (e.g. form validation errors) will be sent to the client, internal errors will just send a generic error message (e.g. "please contact tech support. ID: #fa3ca....") and will be logged internally so we can trace them back to their source and ideally fix them.