All fixes

Stop returning stack traces to users

info-leak-stack

Stack traces name your files, line numbers and libraries, which is the outline an attacker wants. Log them server side, return a generic error.

Express

  1. 1 Set NODE_ENV=production to suppress stack traces
  2. 2 Use a custom error handler that doesn't leak internals
javascript 
// Custom error handler
app.use((err, req, res, next) => {
  console.error(err); // log internally
  res.status(500).json({ error: 'Something went wrong' });
});

Does your app still have this?

Scan your domain