Make sure my app doesn't leak internal details through error responses in production. Look at global error handlers, API error responses, and any place an exception message or stack trace could reach the client. Implement environment-aware error handling: in production, unhandled errors return a generic message ("Something went wrong") with a correlation ID, while the full stack trace goes to the server log keyed by that ID. In development, keep the detailed output. Check API responses specifically: database error messages, file paths, framework version info, and environment values must never appear in what the client receives. Also check for debug or verbose flags that might be enabled by config and make sure they're off in production builds. Do not swallow errors silently; everything must still be logged server-side with enough detail to debug. Do not change error status codes that clients legitimately depend on (404s, validation 400s with safe messages). Show me each change. Give me a way to verify: an action that triggers a server error, and confirmation that the client sees a generic message with a correlation ID while the full trace appears in the server log.