HIGH SEVERITYCONFIRMED
Full Python tracebacks returned in HTTP error responses
Package
MiroFish
Version
latest
Verified
2026-03-28
Description
MiroFish returns full Python tracebacks in HTTP error responses via `traceback.format_exc()`. Found 6 occurrences in graph.py, 30 in simulation.py, and 17 in report.py. These expose internal file paths, line numbers, and code structure to clients.
Reproduction
# traceback.format_exc() found in:
# backend/graph.py (6x), simulation.py (30x), report.py (17x)
# Any unhandled exception returns full traceback to HTTP client