SFS C / SF 2

Back to SFS C

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are all organization-owned API endpoints configured to return standardized error messages that do not expose sensitive system information throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented configuration and observed responses confirming error messages follow standardized format without internal system details

Assessment criterion and evidence

Actor: Organization. Scope: All organization-owned API endpoints serving external or sensitive internal systems. Evidence period: Throughout the review period. Required evidence: API documentation specifying error message format requirements; Sample error responses from production environments showing standardized messaging. Negative criterion: Error responses containing stack traces, internal server names, or sensitive technical information. Missing evidence: Pending verification when no error response examples or configuration documentation are provided

View the JSON record (opens in a new tab).

Assessment result: unset.