A municipal API returns stack traces that include resident email addresses in error bodies. How should the tester classify this?
Select an answer to reveal the explanation.
Short Explanation
Error pages that spill personal details are like leaving medical charts on the lobby printer. Verbose API faults that include PII or internals are information disclosure — report them. They are not DNS issues and they are not a free ticket to Domain Admin.
Full Explanation
APIs should return sanitized, client-safe error messages without stack traces, secrets, or personally identifiable information. Verbose faults aid attackers in mapping internals and may directly expose PII. This is an information-disclosure finding class, distinct from DNS or privilege-escalation outcomes. Recommend generic client errors, detailed logging server-side only, and review of error-handling middleware.