Public-facing content controlled, no FCI exposed

CMMC 2.0 AC.L1-3.1.22 (NIST 800-171r2 3.1.22) requires that organizations control information posted or processed on publicly accessible systems. Exposing stack traces, database error messages, internal file paths, or table names in HTTP responses or error pages hands an attacker a reconnaissance map — they learn your ORM, schema structure, file layout, and often your database product from a single failed request. OWASP A05 (Security Misconfiguration) and CWE-209 (Generation of Error Message Containing Sensitive Information) both call this out. In a CMMC assessment, any FCI surfacing in a public error response is a direct finding.

Catch all errors at the API route boundary and return a sanitized message. Log the full error server-side only — the client gets a generic response regardless of what failed:

// app/api/contracts/route.ts
export async function GET(req: Request) {
  try {
    const session = await getServerSession()
    if (!session) return Response.json({ error: 'Unauthorized' }, { status: 401 })
    const data = await db.contract.findMany({ where: { userId: session.user.id } })
    return Response.json(data)
  } catch (error) {
    console.error('[contracts/GET]', error) // Full error to server logs only
    return Response.json({ error: 'An error occurred. Please try again.' }, { status: 500 })
  }
}

In app/error.tsx, never render error.message or error.stack — those fields contain internal paths in production Next.js builds. Render a fixed string and a retry button only.