1 Commits

Author SHA1 Message Date
bitr8
a4e6ebaecd
fix(api): Sanitize error responses to prevent information disclosure (#282)
* fix(api): Sanitize error responses to prevent information disclosure

Add error response sanitization to prevent internal implementation details
from leaking to clients in production:

- New errorResponse.ts utility with whitelist-based message filtering
- Safe message patterns allow user-friendly errors through
- Sensitive patterns block stack traces, file paths, credentials, IPs
- Development mode bypasses sanitization for debugging
- Updated global error handler to use sanitization

This prevents information disclosure while maintaining helpful error
messages for common user-facing issues like "not found" or "invalid".

* style: Fix prettier formatting

* ci: trigger rebuild

* fix(types): Add missing type parameters for Record and Set

- Add <string, string> to Record type declarations for mimeTypeMap
- Add <string> to Set constructor for assetPaths

Fixes TypeScript errors in CI.

* style: format with prettier

---------

Co-authored-by: bitr8 <bitr8@users.noreply.github.com>
2026-01-11 22:24:06 +13:00