API failures show a human-readable error message
Why it matters
A silently frozen chat UI after an API failure leaves users without any signal: they do not know whether to retry, wait, or refresh. Worse, mishandled error paths frequently leak raw error objects — stack traces, internal route names, or upstream provider error messages — directly into the rendered output, which CWE-209 (Generation of Error Message Containing Sensitive Information) identifies as an information-disclosure risk. In subscription products, a broken interface with no error message or retry affordance is an immediate churn signal. The combination of user confusion, potential data exposure, and broken UI state makes silent failure the worst possible error-handling outcome.
Severity rationale
Critical because a missing error handler can freeze the UI with `isLoading` stuck as true and may expose raw error objects containing sensitive internal details to end users.
Remediation
Add an error state guard to src/components/chat/ChatWindow.tsx that renders a human-readable message with a retry action. Never surface raw error objects.
{error && (
<div className="bg-destructive/10 text-destructive p-3 rounded-md text-sm">
<p>Something went wrong. Please try again.</p>
<Button onClick={reload} variant="outline" size="sm" className="mt-2">
Retry
</Button>
</div>
)}
For the Vercel AI SDK useChat hook, wire the onError callback to your observability platform (console.error in development, a structured logger in production) so errors are recorded without being echoed to the user.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the AI Chat Visibility Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-209 — Generation of Error Message Containing Sensitive Information
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ai-chat-visibility·automated