[jonchurch]

Here's the spoke page for the error handling part of the Security docs.

Note that we need a better title for this, I left it currently as "Error handling" but that mirrors an existing guide that we have. So we need a better title to not shadow that existing page. Maybe something like "Error responses and disclosure"? Not sure

Another thing I realized is that the error handling guide we already have shows something that I urge not to do in this guide. The existing error handling guide has several example handlers that do res.render('error', { error: err }), passing the whole error object into the template. That's exactly the kind of leak this page tells people to avoid. I'm not touching the guide here, but it needs a follow-up PR so the two pages agree.

[netlify]

✅ Deploy Preview for expressjscom-preview ready!

Name	Link
🔨 Latest commit	15d43fb
🔍 Latest deploy log	https://app.netlify.com/projects/expressjscom-preview/deploys/6aea51dd893a35dbde92f511
😎 Deploy Preview	https://deploy-preview-2539--expressjscom-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 94 (🔴 down 3 from production) Accessibility: 100 (no change from production) Best Practices: 100 (no change from production) SEO: 100 (no change from production) PWA: 80 (no change from production) View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[crandmck]

Deploy preview:

• Security checklist - Error handling
• Error handling

I also opened #2549 to capture your comment re the existing error handling guide.

[crandmck]

Note that we need a better title for this, I left it currently as "Error handling" but that mirrors an existing guide that we have. So we need a better title to not shadow that existing page. Maybe something like "Error responses and disclosure"? Not sure

Some other suggestions that emphasize that this specifically addresses security concerns:

• "Secure error handling"
• "Handling errors securely"
• "Handle errors securely" (matches imperative form used in subheads)

[crandmck]

Hope this is not too much! I used suggestions to try to make it easier fo you.

[bjohansebas]

LGMT!