Will It Vibe?HTTPException detail built from the caught exception
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
An except block raises HTTPException with detail=str(e) or detail=e, passing the caught exception's message straight to the client. Exception messages routinely contain file paths, SQL fragments, or connection strings, so this hands internal implementation detail to whoever triggered the error.
Why it matters
Building an HTTPException detail from str(e) or the exception object itself takes whatever message the underlying library produced and forwards it verbatim to the client. Exception messages routinely include file paths, SQL fragments, connection strings, or third-party library internals, none of which should reach an untrusted caller, and the practice makes it easy to accidentally leak something sensitive the day an unrelated dependency changes its error format.
How to fix it
Log the full exception server-side (logger.exception(...) or your existing logging setup) and raise HTTPException with a fixed, generic detail message instead. If the client genuinely needs to distinguish error cases, use a small set of stable error codes or messages you control, never the raw exception text.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo