> If you're raising an exception deep in some internal code, provide as much detail as possible. > If the error bubbles up to the user, ...then you have an in

> If you're raising an exception deep in some internal code, provide as much detail as possible. > If the error bubbles up to the user, ...then you have an information disclosure vulnerability! There's a really good reason why we don't bubble up deep exceptions to end users: Attackers can use that info to gain information about your back end that they can use to find worse vulnerabilities. Put all the detail you want in your logs. Keep the end users out of it. They shouldn't be able to tell what line broke things.