Error messages don't leak sensitive info

Distinct error messages for "user not found" versus "wrong password" let an attacker enumerate valid email addresses with a single automated script, turning a minor information leak into a targeted credential-stuffing campaign. NIST 800-53 rev5 SI-11 (Error Handling) prohibits revealing system internals or data states in user-facing messages; AU-3 requires that sensitive detail be captured in server-side logs only. CWE-209 (Information Exposure Through an Error Message) and OWASP A05 (Security Misconfiguration) both flag this as a systematic vulnerability. Database exception strings leaked to the browser also reveal table names, column names, and query structure.

Collapse all authentication failure branches into a single generic message. Log the specific cause server-side with the user identifier so your team retains forensic visibility.

// app/api/login/route.ts
export const POST = async (req: Request) => {
  const { email, password } = await req.json()
  try {
    const user = await db.user.findUnique({ where: { email } })
    const valid = user && await bcrypt.compare(password, user.passwordHash)
    if (!valid) {
      logger.warn({ email, found: !!user }, 'failed login attempt')
      // Same message regardless of which branch failed
      return Response.json(
        { error: 'Invalid email or password' },
        { status: 401 }
      )
    }
    // ... issue session
  } catch (err) {
    logger.error({ err }, 'login error')
    return Response.json({ error: 'An error occurred' }, { status: 500 })
  }
}

Apply the same pattern to registration ("An account with that email already exists" leaks existence), password reset, and any form that queries user records.