vetkit.spring.error.stacktrace-exposed

Spring Boot always includes stack traces in error responses (server.error.include-stacktrace=always). Every client sees internal classes, library versions and sometimes data.

Last updated: 2026-11-01

Suite: Security

regex

Spring Boot always includes stack traces in error responses (server.error.include-stacktrace=always). Every client sees internal classes, library versions and sometimes data.

Category: SECURITY · Engine rule severity: WARNING

How to fix it

Use the default (never) or on_param only in non-production profiles.

References

https://docs.spring.io/spring-boot/appendix/application-properties/index.html#application-properties.server.server.error.include-stacktrace

Source: packages/engine/rules/sast/config.yml.

Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.