Skip to content

Skill

Secure Error Handling

harperaa

A secure-coding pattern for the error path: return generic, environment-aware messages to users while logging the detail server-side, so a stack trace, database error, or file path never hands an attacker a map of your system. It shapes how failures are surfaced - not a scanner that finds the leaks for you, and narrower than a full security review: it does not cover auth, input validation, or the other vulnerability classes, only how errors are reported.

A situation it fits

After last Tuesday's PostgreSQL meltdown, the company's public 500 page leaked the live connection string and internal locations to every visitor, so the CTO demanded a coding convention that shows zero implementation detail to browsers while keeping all diagnostics in a backend log.
Secure Error Handling. The skill shapes the visible side of failures by framing a coding convention: it tells you to give browsers a bland, context-aware notice and to sequester every technical artifact - live connection strings, internal locations, diagnostic output - inside server logs, which exactly resolves the split the CTO asked for. semgrep-rule-creator-trailofbits is the genuinely tempting distractor because the leak feels like a source-level artifact you could catch with a static-analysis rule, but that skill merely writes reusable Semgrep detection rules for specific bug patterns and paired test cases; it never influences what a web framework displays on an HTTP response or where operational logs are directed, so it cannot close the gap between user-facing text and backend retention.

Skills it gets confused with

These share a family with Secure Error Handling, which is another way of saying they are the ones you might reach for by mistake.

Every comparison with Secure Error Handling

Knowing what Secure Error Handling does is the easy half. Telling it apart from the others under time pressure is the game.

Today's session

Secure Error Handling is part of harperaa/secure-claude-skills. Licence: MIT. The description above was written for this game, not taken from the skill.