🔒 security: fix unhandled exception details exposure

Replace detailed exception strings with generic error messages in
the health and generate endpoints to prevent information leakage.
Internal logs still contain full exception details for debugging.

Co-authored-by: LyAhn <27559362+LyAhn@users.noreply.github.com>
This commit is contained in:
google-labs-jules[bot]
2026-04-28 14:36:06 +00:00
parent e2f52473ea
commit adebfceeb0
+2 -2
View File
@@ -192,7 +192,7 @@ def _load_model_sync() -> None:
except Exception as exc:
_model_status = "error"
_model_error = str(exc)
_model_error = "Internal server error during model initialization."
logger.exception("Failed to initialise model: %s", exc)
@@ -355,7 +355,7 @@ async def generate(req: GenerateRequest, request: Request) -> StreamingResponse:
return
except Exception as exc:
logger.exception("Generation failed: %s", exc)
yield _sse({"type": "error", "message": str(exc)})
yield _sse({"type": "error", "message": "Internal server error during generation."})
return
elapsed = round(time.monotonic() - start, 1)