Secure Error Handling

This implements environment-aware error handling that shows full stack traces in development but returns generic messages in production, preventing information leakage that attackers use for reconnaissance. You get five handlers for different HTTP status codes: handleApiError for 500s, handleValidationError for 400s, handleForbiddenError for 403s, handleUnauthorizedError for 401s, and handleNotFoundError for 404s. All errors get logged server-side with full context while clients only see safe messages. The approach is straightforward and solves a real problem: detailed error messages revealing database schemas, file paths, dependency versions, and system info that make attacks easier. Use this in any API route where you're catching errors and want to stop leaking implementation details to users.

skills.sh installs: 197
GitHub stars: 18
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add harperaa/secure-claude-skills --skill secure-error-handling --agent claude-code

Installs into .claude/skills of the current project.

Files

Secure Error Handling - Preventing Information Leakage

The Error Message Problem

Error messages are designed to help developers debug. But in production, detailed errors help attackers more than they help users.

What Attackers Learn from Error Messages

Database structure:

Error: column 'credit_cards.number' does not exist

→ Attacker now knows you have a credit_cards table

File paths:

Error at /var/www/app/lib/payment.js:47

→ Attacker learns your directory structure

Dependencies:

Stripe API error: Invalid API key format

→ Attacker knows you use Stripe

System info:

PostgreSQL 9.4 connection failed

→ Attacker learns your database version and can look up known vulnerabilities

Real-World Information Leakage

According to SANS Institute research, 74% of successful attacks start with reconnaissance phase where attackers gather information about the target system. Error messages are a primary source of this intelligence.

Equifax Breach (2017): Detailed error messages revealed they were using Apache Struts with a known vulnerability. Attackers exploited this revealed information.

SKILL.md on GitHub