How do you prevent sensitive information from leaking through exception responses in production NestJS apps?
Branch on NODE_ENV inside the filter. In production, log the full error but return only a generic 500 message to the client. In development, include the stack trace in the response for easier debugging. Never include database error messages, stack traces, or internal paths in production responses.
Environment-aware safe exception filter
Production security rules for error responses:
Never include stack traces, SQL queries, or file paths in production error responses.
Only expose validation error details (field names, constraint messages) on 4xx client errors.
Always return a generic message for 5xx errors — internal details are for server logs only.
Log the full error including stack trace server-side before sending the sanitized response.
Use ConfigService to branch on NODE_ENV — never hardcode environment checks.