review: error text reaches API clients on three route handlers (js/stack-trace-exposure)

Open
#415 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
typescript
Domain
api, backend, security

Research direction

Start by tracing the seven CodeQL flows in backend-ts/src/routes/runs.ts, backend-ts/src/routes/measures.ts, and backend-ts/src/worker.ts. Read docs/PRODUCTION_READINESS_2026-07.md and docs/COMPLIANCE_API.md, then classify which details are developer-facing versus client-facing. Done means the response contract is decided and checked against the API stability statement.

Written by the indexing model from the issue text.

Description

What

CodeQL raises js/stack-trace-exposure (medium) at three sinks:

File Line Paths
backend-ts/src/routes/runs.ts 157 5
backend-ts/src/routes/measures.ts 163 1
backend-ts/src/worker.ts 194 1

Each is the module's json() helper; the flagged flow is an caught error whose message ends up in the response body.

Why this is filed as review rather than a fix

Unlike the other three items from the first scan, this one has no mechanically correct answer. It is a judgement call about how much diagnostic detail the API should return, and the two failure modes point in opposite directions:

  • Returning error text leaks internals — module paths, driver messages, and on a WebChart-backed stack potentially fragments of clinical data in a serialization error. docs/PRODUCTION_READINESS_2026-07.md sets the PHI posture this has to satisfy.
  • Returning nothing useful makes a 500 undiagnosable for MIE, who consume the versioned compliance API (docs/COMPLIANCE_API.md) and cannot read our logs.

The likely shape is a correlation id in the response plus the detail in run_logs / the audit trail, but that is a design decision, not a find-and-replace.

Scope

  1. Enumerate the seven flows and classify each: developer-facing detail vs client-facing message.
  2. Decide the contract — probably an opaque id the client can quote back.
  3. Check it against the stability statement in docs/COMPLIANCE_API.md, since response-body shape is part of that contract.

Not urgent

Auth is on for these routes and the deployed stack is a demo tenant. This is worth doing properly rather than quickly.

Dominant language
TypeScript
Stars
0
Forks
0
Avg merge
6h 6m
Merged PRs (30d)
69

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Taleef7/workwell

All issues in Taleef7/workwell

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.