A city API gateway exposes verbose error messages with stack traces during recon. How should that be framed?
Select an answer to reveal the explanation.
Short Explanation
Stack traces in API errors are the app thinking out loud in public. Paths, versions, and logic clues spill out for anyone who can trigger them. That is disclosure — log it even without a shell.
Full Explanation
Verbose error messages and stack traces from a city API gateway are information-disclosure weaknesses that aid attackers and are reportable findings during recon. Detailed errors do not prove the API is secure, nor do they appear only for authorized testers in a protective sense—they leak to whoever can trigger them. Shell access is not a prerequisite for reporting disclosure. Error-based disclosure is relevant to web recon, not only physical assessments. Exam caveat: redact secrets in report excerpts while still proving the disclosure class to municipal developers. Operational check: capture representative stack traces with timestamps, note revealed paths/versions, assess how they enable follow-on attacks, and recommend generic client errors with server-side logging for the gateway. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.