From c13b955a36325c4d152ce01bacaba8549cfc1a2d Mon Sep 17 00:00:00 2001
From: "Abdullah." <125115953+mabdullahabaid@users.noreply.github.com>
Date: Wed, 17 Dec 2025 22:29:40 +0500
Subject: [PATCH] fix: hide GraphQL stack traces and messages in production
 (#16593)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Resolves [Code Scanning Alert
180](https://github.com/twentyhq/twenty/security/code-scanning/180).

- Normalize unexpected GraphQL errors in convertExceptionToGraphql to a
generic "Internal Server Error" instead of exposing exception.name
directly to clients.
- Only attach stack and response (original error message) in
development, so production responses don’t leak internal class names,
implementation details, or stack traces, while observability is
preserved via `ExceptionHandlerService`/Sentry.
- Keep behavior consistent with `convertHttpExceptionToGraphql`, which
also only exposes detailed response and stack information when `NODE_ENV
=== DEVELOPMENT`.
---
 .../src/engine/utils/global-exception-handler.util.ts     | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/packages/twenty-server/src/engine/utils/global-exception-handler.util.ts b/packages/twenty-server/src/engine/utils/global-exception-handler.util.ts
index f8c98b4ae0..a9500a7761 100644
--- a/packages/twenty-server/src/engine/utils/global-exception-handler.util.ts
+++ b/packages/twenty-server/src/engine/utils/global-exception-handler.util.ts
@@ -150,12 +150,14 @@ const convertHttpExceptionToGraphql = (exception: HttpException) => {
 
 export const convertExceptionToGraphql = (exception: Error) => {
   const error = new BaseGraphQLError(
-    exception.name,
+    'Internal Server Error',
     ErrorCode.INTERNAL_SERVER_ERROR,
   );
 
-  error.stack = exception.stack;
-  error.extensions['response'] = exception.message;
+  if (process.env.NODE_ENV === NodeEnvironment.DEVELOPMENT) {
+    error.stack = exception.stack;
+    error.extensions['response'] = exception.message;
+  }
 
   return error;
 };