<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-error-handling-securely
description: >-
  Design error handling that prevents information disclosure while maintaining debugging.
domain: cybersecurity
subdomain: secure-coding
tags:
  - error-handling
  - information-disclosure
  - logging
  - secure-coding
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Implementing Error Handling Securely

## Overview

Design error handling that prevents information disclosure while maintaining debugging.

## Prerequisites

| Requirement | Install |
|---|---|
| Logging framework | Structured logging |
| Error monitoring | Sentry |
| Python 3.10+ | For agent tooling |

## Key Concepts

Secure error handling returns generic messages to users while
logging details internally. Prevent stack traces and DB errors.

## Quick Reference

```bash
import logging; logger = logging.getLogger(__name__)
node agent.js audit --directory src/ --check error-handling
node agent.js scan --directory src/ --pattern 'except Exception'
node agent.js generate --type error-handler --framework flask
```

## Workflow

1. Inventory exception handlers
2. Replace bare excepts
3. Generic user errors
4. Log details server-side
5. Custom error pages
6. Configure monitoring
7. Test disclosure

## Detection

```yaml
title: Error Handling Securely Detection
id: c76e8315-a559-4b71-876a-64a3bab5188a
status: experimental
description: Detects suspicious activity related to implementing error handling securely techniques in secure coding context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.initial_access
falsepositives:
  - Static analysis tools scanning source code repositories
```

## Verification

- No stack traces
- Specific catches
- Monitoring works
- Custom error pages
- Generic messages

## References

- OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/
- MITRE ATT&CK — https://attack.mitre.org/
- NIST SP 800-53 — https://csf.tools/reference/nist-sp-800-53/
