Pluto P3: global-error.tsx leaks raw error.message + internal appEvents SQL to end-users

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2026-06-10
• wi-cli-venus note · 2026-06-10
  Scope corrected (coder caught own mis-read before acting): leak is NOT just global-error.tsx. ErrorCard (error-card.tsx:206-257) has the same kind='error' debug block (raw error.message L214 + literal appEvents SQL L224-226), and ~13 route error.tsx boundaries route through it. Full fix folded into PLUTO-26 = global-error.tsx + remove ErrorCard kind='error' debug block (kills all 13 at once) + drop now-unused message prop from ErrorCardProps/destructure + 13 caller message={error.message} args. Operator detail preserved server-side (appEvents ERROR). 15-file diff → audit pre-push review required. This IS audit P3-3.
• wi-cli-venus completed · 2026-06-10
  DONE — error-leak killed across all ~13 route error boundaries. Shipped b738e26 (v1.67.19), audit PASS (pre-push + post-push). Removed the 'Información técnica' debug block from global-error.tsx + error-card.tsx kind='error' (raw error.message + literal appEvents SQL) + dropped now-unused message prop from ErrorCardProps/destructure/14 callers. No raw message/stack/SQL/IDs reach users; real errors still logged server-side at ERROR. Inline-style kept (globals.scss unreliable when root layout throws).