API 500 responses currently return SQL text and row images of citizen records to make debugging easier for mobile clients. What should the API return instead?
Select an answer to reveal the explanation.
Short Explanation
Clients get a polite "something went wrong," not a SQL autopsy with citizen rows attached. Park the gory details in locked server logs where on-call can read them.
Full Explanation
Error responses to clients must minimize sensitive data: return generic messages and correlation IDs while detailed SQL, stack traces, and record contents remain in secured logs. Returning row images, SSNs, plaintext data keys, or result-set dumps violates data minimization and expands breach impact when errors reach untrusted clients.