The @Public() health controller builds new HttpException({ ..., error }, ...) in each catch block (health.controller.ts:44-54,81-90,128-141,...), embedding the raw caught error into the 503 body. A failing DB/Redis/Stellar check thus returns internal messages (connection strings, hostnames, stack fragments) to anyone hitting /api/v1/health/*. Fix: log the error server-side and return only a generic status string to the client.
The
@Public()health controller buildsnew HttpException({ ..., error }, ...)in each catch block (health.controller.ts:44-54,81-90,128-141,...), embedding the raw caught error into the 503 body. A failing DB/Redis/Stellar check thus returns internal messages (connection strings, hostnames, stack fragments) to anyone hitting/api/v1/health/*. Fix: log the error server-side and return only a generic status string to the client.