Error handling covers PRD-specified edge cases
Why it matters
PRD-specified error states are requirements, not suggestions. When a user hits their usage quota and your app returns an unhandled 429 or a generic error page instead of the renewal prompt your PRD specified, you have broken the user experience the product owner signed off on. More critically, unhandled error paths often expose raw API error messages, stack traces, or internal IDs to end users — a violation of both good UX and basic information security hygiene. ISO 25010:2011 reliability requires that specified failure scenarios are handled gracefully, not just that happy paths work.
Severity rationale
Medium because unhandled PRD error states degrade user experience and may leak internal error details, but do not directly expose a security-critical attack vector.
Remediation
For each unhandled PRD error scenario, locate the triggering condition in your API route handlers and add the corresponding UI state. In a Next.js app, quota exceeded handling looks like:
// src/app/api/generate/route.ts
if (userUsage >= plan.limit) {
return NextResponse.json(
{ error: 'quota_exceeded', upgradeUrl: '/pricing' },
{ status: 402 }
)
}
Then handle it in the client component in src/components/ with a modal or inline message matching your PRD spec. Cross-check every error scenario in your PRD against the response codes your API routes actually return — the gap is usually in the client-side error boundary, not the server logic.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Goal Alignment Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · reliability.fault-tolerance — Reliability — Fault Tolerance
Taxons
History
- 2026-04-18·v1.0.0·Initial import from goal-alignment·automated